Epic: implement the OCAP enforcement floor (complete mediation) — algebra is sound, enforcement is the gap

[hartsock]

Finding (docs/ocap/authority-model-design-review.md §7 + the paper docs/ocap/caveat-lattice-paper.md)

The Caveats meet-lattice algebra is sound (GLB on all 6 axes; property-tested) and the per-axis predicates already exist (newt-core CaveatsExt: permits_fs_read/fs_write/exec/net + permits_one_more). The gap is the enforcement floor: the crew/team path consults only fs_write (+ top-level exec), ignores fs_read/net/max_calls, and crew_runner never .meet()s — crews run at the full session grant despite docstrings claiming attenuation. This epic implements complete mediation (Saltzer & Schroeder 1975): the algebra made real.

Stacked PR series (review + merge in order; each TDD: red on today's code, green after)

1. docs — the design review + the caveat-lattice paper (the rationale). [docs/ocap-authority-review]
2. crew_runner .meet-attenuates the crew to ≤ session + true docstrings (the structural Confused-Deputy bound).
3. crew.rs complete mediation: fs_read (navigator reads gated by permits_fs_read).
4. crew complete mediation: net + max_calls (permits_net + permits_one_more).
5. gate the team-mode per-subtask verify (exec axis).
6. role_profile clamp — NamedPermissionPreset clamps fs_read + default-deny (fix the default-top).
7. route run_team through Plan/run_plan (+ the plan-path re-entry gap).
8. per-subtask team_clamp (now with teeth) + the ceiling-tightness lint.

Each step's TDD test is a machine-checked claim; the before/after is empirical evidence for the conference-paper series (paper 1 = docs/ocap/caveat-lattice-paper.md). Single-repo (newt-agent); the agent-mesh algebra is sound + unchanged. Refs #739, #741.

[hartsock]

Stack status — checkpoint (review/merge bottom-up)

#	PR / issue	what	state
1	docs docs/ocap-authority-review	design review + caveat-lattice paper (the rationale)	re-pushed at end of queue
2	PR #751 (→ main)	crew_runner .meet() seam + honest docstrings	✅ gate-green
3	PR #759 (stacked on #751)	crew fs_read complete mediation	✅ gate-green
4	#753	crew max_calls bound + honest net scoping	🔨 building
5	#754	gate team-mode per-subtask verify (exec)	queued
6	#755	role_profile clamp fs_read + default-deny	queued
7	#756	route run_team through Plan/run_plan	queued
8	#757	per-subtask team_clamp + ceiling lint (capstone)	queued
—	#758	prefix/glob-aware Scope (algebra refinement)	follow-up

Each PR carries a red-on-today / green-after TDD test — the machine-checked claims paper 1 (docs/ocap/caveat-lattice-paper.md) cites. Single-repo (newt-agent); the agent-mesh meet algebra is sound + unchanged. The serial cov-ci gate (shared target) paces merges; PRs land foundation-first.