[CI] Fix builtin capability fallback for --all on clean hosts #410

Outcome

Restore a completely green Renderflow default branch by making the canonical --all dry-run path resolve from the built-in capability registry on a clean Ubuntu host, without conflating registered, policy-allowed, provider-available, and selected capabilities.

Observed live baseline

Reproduced from the merged main baseline at 1eafaf54d33a984377a7a3e327ee87382da73307.

• Main CI run: https://github.com/egohygiene/renderflow/actions/runs/34775426178
• Failing job: build-and-test / Test
• Regression: test_all_without_transforms_uses_builtin_capability_registry
• Clean-run diagnostic: target selection resolved to no available branches; inspect the artifact-forest plan or relax provider/policy constraints
• The adjacent target-specific fallback test passes.
• The failure is host-dependent: a developer machine with Pandoc installed can hide it.

The current planner first expands all_reachable against the policy-filtered built-in graph, then removes every optional branch whose provider is unavailable. On a clean host without Pandoc, every Markdown derivative is removed before an inspectable dry-run plan can be returned.

Scope

• Make renderflow build --all --dry-run with a valid config and no transforms file resolve through the built-in capability registry on a clean Ubuntu-like host.
• Preserve truthful unavailable/blocked branch reporting in the artifact forest and diagnostics.
• Preserve the target-specific blocked-provider fallback behavior.
• Preserve execution preflight: an unavailable external provider must not be reported as installed or executed successfully.
• Add deterministic regression coverage that does not depend on the developer host's installed tools.
• Keep the canonical planner, execution evidence, schemas, docs, and provider contracts coherent.
• Do not weaken CI, skip the test, install Pandoc merely to hide the regression, or expand product scope.

Acceptance criteria

• The clean-host test_all_without_transforms_uses_builtin_capability_registry regression passes.
• --all --dry-run returns machine-readable canonical plan evidence even when every policy-allowed derivative requires an unavailable external provider.
• The plan distinguishes registered/policy-allowed branches from provider-available selected branches and records unavailable branches honestly.
• A non-dry-run attempt still fails closed at provider preflight when required providers are unavailable.
• Existing target-specific fallback coverage remains green.
• Tests cover zero available branches and mixed available/unavailable branches without relying on PATH contents.
• cargo fmt --all -- --check, strict workspace Clippy, build, the complete workspace test suite, generated docs/schema checks, conformance, package checks, and relevant manual smoke tests pass.
• Required GitHub Actions checks are green on the PR and resulting main before closure.

Relationships

• Follow-up to [CI] Restore green main after Clippy and generated-doc drift #407 and PR fix(pipeline): restore validation baseline #408.
• Contributes to [EPIC] Finish the flow suite and prove production-ready orchestration flow#11.
• Preserves the artifact-forest/provider-availability contract tracked by Roadmap: universal artifact forest, maximal Renderflow profile, and Flow orchestration readiness #367.