fix(workerd): accept current plugin capability names

[logelog]

What does this PR do?

Fixes the Workerd sandbox rejecting manifests that declare current capability names for content, media, users, and network access.

The bridge and generated wrapper now normalize manifest capabilities before checking them. Current names authorize the matching APIs, supported legacy aliases remain accepted, and permission errors report the current names. This also exposes ctx.users when a manifest declares users:read.

Regression coverage exercises current and legacy names through the bridge, generated wrapper, and a real Workerd process. The existing Tests job now runs the deterministic Workerd capability tests because pnpm test:unit does not include @emdash-cms/sandbox-workerd.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main. Not applicable: this PR does not change the admin UI.
• I have added and reviewed the user-facing changeset (if this PR changes a published package)
• New features link to an approved Discussion: not applicable; this is a bug fix.

AI-generated code disclosure

• This PR includes AI generated code: Claude Opus 5, GPT 5.6 (via private dev orchestra)

Screenshots / test output

Current head 4128e41afdb828422440076e133fc93dfb15d311 is a conflict-free rebase of the Windows-validated candidate e94fe43fd780e33a8784da16613d9d06308d4df5 onto ade23cdc9b400ba34bb1cad5f9fb5a4d3793114f. The source patch is unchanged, and both revisions have stable patch ID 9db0092bb0d7d7d2a145ca1673e64e46a3bcfc8c.

• macOS arm64 after the rebase, with Node.js 22.23.2 and pnpm 11.9.0: targeted lane 51/51 and full Workerd suite 127/127, with zero skipped tests. Workerd build and typecheck, root typecheck, lint, pnpm format, and git diff --check passed.
• Windows 11 x64 on the patch-equivalent pre-rebase commit: targeted lane 51/51 and full Workerd suite 127/127, with zero skipped tests. The integration file passed 18/18 using a real Workerd process; removing the binary as a negative control produced 18 skipped tests, confirming the full run did not silently skip runtime coverage.
• Windows build, Workerd and root typechecks, lint, Prettier, and git diff --check passed. pnpm format:check reported the same 10 symlink-checkout files on the pristine base and candidate because the Windows checkout had core.symlinks=false; this was not a candidate regression.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4128e41

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@emdash-cms/sandbox-workerd	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Scope check

This PR changes 640 lines across 12 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@2574

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@2574

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@2574

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@2574

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@2574

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@2574

emdash

npm i https://pkg.pr.new/emdash@2574

create-emdash

npm i https://pkg.pr.new/create-emdash@2574

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@2574

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@2574

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@2574

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@2574

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@2574

@emdash-cms/registry-verification

npm i https://pkg.pr.new/@emdash-cms/registry-verification@2574

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@2574

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@2574

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@2574

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@2574

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@2574

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@2574

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@2574

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@2574

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@2574

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@2574

commit: 4128e41