feat(cgs): support read-only actions

[neithanmo]

Summary

• add optional effect: read author attestation for narrowly proven RPC-shaped kind: action capabilities
• keep unannotated actions fail-closed as remote side effects
• validate contradictory declarations (side_effect outputs, mutation sinks, or non-action kinds)
• propagate derived read/write semantics through discovery, plan lowering, flow checks, presentation, scheduling, and projection hydration
• document the authoring and safety contract

Why

kind: action is the catch-all for operations that do not fit the normal REST-oriented capability kinds. Most actions are effectful, but some APIs expose narrowly provable read-only RPCs as actions. Previously CGS could not express that distinction.

This remains opt-in and fail-closed: operation names, HTTP methods, idempotence, and response shape do not infer safety. The attestation must cover complete downstream behavior. Broad dispatchers whose behavior depends on arbitrary providers or plugins remain unannotated.

Semantics

kind: action              # defaults to remote side effect

kind: action
effect: read              # reviewed, narrowly proven read-only RPC

query, search, and get remain reads without an annotation. create, update, and delete remain writes.

Validation

• cargo check -p plasm-core -p plasm-runtime -p plasm-agent-core
• cargo test -p plasm-core validates_read_effect_trust_boundary --lib
• cargo test -p plasm-agent-core read_action_effect_and_output_matrix_lower_without_ack_shape --lib
• cargo run -p plasm-cli --bin plasm-cgs -- schema validate apis/grafana
• cargo fmt --all
• git diff --check