[feat] CLI-01: capability gate defaults to open + STAR_CAPS env

[vt128]

Default posture → open (opt-in sandboxing), with a STAR_CAPS env knob

Per maintainer decision, flip the capability model: the CLI is open by
default (every wired module loadable, including cmd) so scripts just work,
and sandboxing is opt-in rather than the default-deny shipped in #8.

What changed

• New open tier (everything incl. exec) is the default. --caps now
  accepts open | full | network | safe; an empty value resolves to open.
• STAR_CAPS env var sets the default tier for a whole deployment (an
  explicit --caps still wins). Lock a deployment down with STAR_CAPS=safe.
• When the grant is fully open, BuildBox installs no policy (plain
  starbox.New) — exactly the permissive pre-gate behaviour, so an unknown
  -m module errors at the loader again (the characterization test for that is
  restored). A restrictive tier/flag still builds NewWithPolicy and gates.
• An unrecognised --caps value is rejected with a clear error rather than
  silently falling open — a typo'd lockdown (STAR_CAPS=saef) fails loud, not open.

Unchanged

The gate machinery, the union classification (web/s3/sqlite = net|fs),
and the cmd-gated-alone rule all stay — only the default and the env knob
are new.

$ ./starcli -c 'load("http","get")'                    # open: loads
$ ./starcli --caps safe -c 'load("http","get")'        # sandbox: withheld (exit 4)
$ STAR_CAPS=safe ./starcli -c 'load("http","get")'     # deployment default: withheld
$ ./starcli --caps saef -c 'print(1)'                  # typo: errors, never opens

README + flag help updated. Coverage 73.2% (≥ 65); Docker golang:1.22 green.