Fill in the capability matrix: separate what a harness cannot do from what we have not built

The matrix now publishes skill 4/17 and command 4/17. Those dashes are the backlog, but as printed they are unreadable: a `—` means both "this harness has no such mechanism" and "we never built it", and only the second is work. First step is to separate them. A cell should say one of: - supported, and here is what install writes - possible, not built yet — the backlog - not possible, and why — aider has no MCP client at all, and that is a fact about aider, not a gap in deja Only the middle state is a to-do list. Today all three render as the same character, which is why coverage this thin went unnoticed for so long. ## Known concrete gaps The two bundles are not the same product: ``` claude-plugin/ manifest mcp hooks command skill codex-plugin/ manifest mcp — — skill ``` Someone installing through the Codex bundle gets no `/deja` and no hooks. `claude-plugin/commands/deja.md` and `claude-plugin/hooks/deja.sh` have no counterpart there, and nothing in the tests says they should. Conversely the matrix probably understates commands: `claude-plugin/` ships `commands/deja.md`, and Cursor, Qwen, OpenClaw and Copilot read that bundle — so they may already have `/deja` while the matrix prints `—` for them. Same class of mismatch as the missing skill in #1188, in the other direction. Verify before changing the number. ## Order worth working in 1. Split the three states in the registry and the rendered matrix, so what follows is a real list rather than an impression. 2. Close the bundle asymmetry: the Codex bundle should carry what the Claude one does, or the docs should say why it does not. 3. Establish, per harness, whether a skill and a command are possible at all, and record the answer with a source. Some of these will be "no mechanism exists", and writing that down is as valuable as building the ones that do. 4. Then build, one harness at a time, each with the drift test extended so the new claim cannot rot. Point 3 is the one to resist rushing. Declaring a capability in the registry turns it into a promise the test enforces and the README publishes; a guess there is worse than a dash.