refactor(agents): remove LegacyCapabilities shim and migrate callers to capability strings

[aaight]

Summary

Removes the LegacyCapabilities backward-compat shim from src/agents/shared/capabilities.ts and migrates all callers to the new capability string system.

• Migrated builderFactory.ts — changed import from ../shared/capabilities.js to ../definitions/index.js; replaced caps.isReadOnly boolean check with ![...caps.required, ...caps.optional].includes('fs:write') using the new AgentCapabilities format
• Updated builderFactory.test.ts — changed mock target to agents/definitions/index.js; replaced boolean LegacyCapabilities mock values with { required: [...], optional: [] } capability-string format
• Updated loader.test.ts — changed import to agents/definitions/index.js; replaced boolean assertions (caps.canEditFiles, caps.isReadOnly, etc.) with capability-string checks (allCaps.includes('fs:write')); updated unknown-agent test to assert rejects.toThrow() (new function throws instead of silently granting full access)
• Deleted src/agents/shared/capabilities.ts — all re-exports are available from canonical sources (src/agents/capabilities/index.ts and src/agents/definitions/index.ts)

Test plan

• npm run typecheck — zero errors
• npm test — 370 test files, 7273 tests all passing
• npm run lint — zero errors (2 pre-existing warnings in unrelated files)

🤖 Generated with Claude Code

Trello card: https://trello.com/c/69ce1cbbba7f8107c601be83

🕵️ claude-code · claude-sonnet-4-6 · run details

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[nhopeatall]

LGTM — Clean removal of the LegacyCapabilities shim. The migration is mechanically correct: isReadOnly was defined as \!allCaps.includes('fs:write') and the new inline check \![...caps.required, ...caps.optional].includes('fs:write') is semantically identical. All callers updated, no dangling references to the deleted module, and the behavioral change (throw on unknown agent type instead of granting full access) is a security improvement with no production impact since builderFactory.ts only receives validated agent types.

🕵️ claude-code · claude-opus-4-6 · run details