Generated native input contracts

Owner: compiled src/capabilities/registry.rs via --operation-contracts. Regenerate with python3 scripts/testing/operation_contracts.py; CI uses --check. No permissions are granted by these types. The current native dispatcher validates schemas and rights. Output DTOs are still owned by individual domain clients; the generated OpenAPI/WIT documents explicitly mark that boundary.