majordomus capture

Every prompt is kept three times under one stem: the .json record is the provider's own spans, pretty printed and unchanged, the .md beside it is that record rendered for a person and the .yaml the same for a machine. 'capture render' rebuilds a missing rendering from its record and never writes a record. The schema identifier resolves to share/schemas/<vendor>/<name>/<name>.v<n>, as .schema.json for the record and .proto for the document. 'capture prompt' and 'capture session' never exit 2: they run inside a provider hook, where that exit code can reject the person's prompt. Neither writes to stdout on a start event, because the provider adds it to the model's context. install refuses to rewrite a configuration it did not write, and prints the entries to add. A record carries the episode it belongs to, the provider session, the repository and the worktree, with the provenance of that link: the mapping from a provider session to an episode exists only while the episode is open, so a record that did not carry it could never be attributed afterwards. 'capture reconcile' links a record from evidence that survived the close and marks the rest unlinked rather than guessing; 'capture prune' applies prompts.retention_max_days and prompts.retention_max_bytes by taking the body and keeping the record, its identity and a tombstone. Credential shapes are replaced before anything is persisted, and the archive is mode 0600.