Cover the capability store in the kind capability test #133

tests/capabilities/run.sh starts the rendered runner pod in kind and checks the capabilities really work, but only with copies into each pod. The capability store from #132 isn't covered there: its entries are named for each image's digest, and the test builds its tool and library images locally and loads them into kind, so they have no registry digest to pin.

Running a local registry in the test (push the built images, reference them by the digest the push returns) would let it render a profile with capability_store: true and check what only a real pod shows: the hostPath store and its preparation under the pod's real securityContext, the publish and sysroot merge with busybox, the tool cache's links resolving for @actions/tool-cache, the sysroot subPath mount, and a second pod reusing the entries without copying. The unit tests run the same scripts with sh against a temporary store, which covers the logic but not the mounts or the identities.