AMPR-263 #664: Add TableWriteIntent core primitives and PlugManifest capability gating

[wow-miley]

Closes #664

Written by Claude (Sonnet 5), implementing the core, provider-neutral half of the AMPR-263 write-back verdict (append-row and update-cell as provider-delegated intents, never a whole-table replace): TableWriteIntent/TableRowRef/TableWriteCapability/TableWriteFailure, and a TableWriteSink guard base that enforces the capability gate before any dispatch, mirroring WritableCanonAdapter's guard shape. Adds a matching PlugManifest.tableWriteCapabilities declaration and validator rules (undeclared-TABLE-contract and canon-external contradictions), mirroring the existing isCanonExternal carve-out pattern.

Concrete Notion/Sheets/CSV sink implementations are intentionally not included — no real transport for any provider exists yet in this repo to implement them against.

Test plan

• ./gradlew :ampere-core:jvmTest (full suite)
• ./gradlew :ampere-core:compileCommonMainKotlinMetadata
• ./gradlew :ampere-core:compileTestKotlinIosSimulatorArm64
• ./gradlew :ampere-core:ktlintFormat (no changes needed)

🤖 Generated with Claude Code

[github-actions]

Concept staleness check — 3 warning(s).

These changes touched files listed under a concept's tracked_sources without updating the concept file. Either update the concept (and bump last_verified) or include a Concept-Verified: <ConceptName> trailer in a commit on this PR.

Validator output

⚠ Concept 'DomainCanon' may be stale: ampere-core/src/commonMain/kotlin/link/socket/ampere/canon/table/TableRowRef.kt matches tracked_sources pattern ampere-core/src/commonMain/kotlin/link/socket/ampere/canon/** but docs/concepts/domain-canon.md was not modified.
⚠ Concept 'LinkLayer' may be stale: ampere-core/src/commonMain/kotlin/link/socket/ampere/plug/PlugManifest.kt matches tracked_sources pattern ampere-core/src/commonMain/kotlin/link/socket/ampere/plug/PlugManifest.kt but docs/concepts/link-layer.md was not modified.
⚠ Concept 'PlugPermissions' may be stale: ampere-core/src/commonMain/kotlin/link/socket/ampere/plug/PlugManifest.kt matches tracked_sources pattern ampere-core/src/commonMain/kotlin/link/socket/ampere/plug/PlugManifest.kt but docs/concepts/plug-permissions.md was not modified.

validate-concepts: 3 warning(s). Validator informs; never blocks.