docs: specify handle-backed object capabilities

[bordumb]

Summary

• specifies handle-backed object capabilities for filesystem and network access
• defines synchronous and Tokio APIs with permission-preserving delegation and attenuation
• introduces typed authorization targets to replace stringly typed scope checks
• covers audit integration, migration, adversarial testing, and cross-platform acceptance criteria

Why

Issue #62 identifies the gap between capsec's class capabilities and resource-bound object capabilities. This specification defines the complete implementation: filesystem authority rooted in open directory handles and network authority represented by immutable endpoint pools.

Review focus

• security invariants and threat model
• public API shape for directory, file, endpoint-pool, and socket capabilities
• the proposed capsec-objects crate boundary
• the CapTarget migration planned for v0.3.0
• sync/Tokio parity and audit coverage

Validation

• git diff --cached --check passed before commit
• Markdown fences and line lengths were checked
• documentation-only change; no runtime tests required

Context: #62