feat(agent): add read-only download.list capability

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/e2e/e2-agent-delegate.test.ts

@@ -45,8 +45,8 @@ describe.skipIf(!hasPg)("E2 Agent 委托闭环(fake 模型 + 真实能力/授权
     return r.body.data.id as string;
   };
 
-  it("启动断言:40 个能力全部注册,并在能力目录里可见", async () => {
-    expect(e.booted.ctx.capabilities.list()).toHaveLength(40);
+  it("启动断言:41 个能力全部注册,并在能力目录里可见", async () => {
+    expect(e.booted.ctx.capabilities.list()).toHaveLength(41);
     const r = await e.api("GET", "/capabilities");
     expect(r.body.data.items.map((c: { id: string }) => c.id).sort()).toEqual(
       e.booted.ctx.capabilities

apps/server/test/sources-identity/site-capabilities.test.ts

@@ -15,8 +15,8 @@ const TiB = 1024 ** 4;
 const SITE_IDS = ["site.list", "site.health_check", "site.refresh_login", "site.user_data"] as const;
 
 describe("站点能力规格", () => {
-  it("进入首批能力目录(17 + 4 只读摘要 + 4 站点 + 10 浏览器 + 2 会话交互 + 2 网页搜索 + 1 元数据补全 = 40);类别 / 风险 / 重放按约定", () => {
-    expect(CAPABILITY_IDS).toHaveLength(40);
+  it("进入首批能力目录(17 + 5 只读摘要 + 4 站点 + 10 浏览器 + 2 会话交互 + 2 网页搜索 + 1 元数据补全 = 41);类别 / 风险 / 重放按约定", () => {
+    expect(CAPABILITY_IDS).toHaveLength(41);
     for (const id of SITE_IDS) expect(CAPABILITY_IDS).toContain(id);
     expect(capabilitySpec("site.list")).toMatchObject({ kind: "read", riskLevel: "low", replay: "safe" });
     expect(capabilitySpec("site.user_data")).toMatchObject({ kind: "read", riskLevel: "low", replay: "safe" });