feat(modalities): add bounded capability contracts (#154)

[tcballard]

Summary

Implements the first, fail-closed foundation slice for gateway compatibility issue #154. Shared Rust routing contracts now model embeddings, image generation, audio, and batch execution as explicit provider capabilities, while the current text gateway rejects known non-text payloads before provider delivery.

Scope

Included

• Add the versioned InferenceSurface and normalized non-text capability contract.
• Apply modality capability checks as hard eligibility exclusions before deterministic scoring.
• Carry the contract through the Apple FFI boundary with stable exclusion reasons.
• Add a bounded gateway modality gate and structured wayfinder_router_unsupported_modality error.
• Add unit, gateway, parity, and documentation coverage in WF-ADR-0067.

Excluded

• Live embeddings, image, audio, or batch provider execution.
• Provider-specific binary handling, cost accounting, concurrency policies, or batch persistence.
• Advertising a non-text route before its adapter and parity fixtures are complete.
• Changes to the deterministic score, tier thresholds, credentials, or existing text provider behavior.

Product / Architecture Decisions

• Modality selection is a capability requirement, never a new input to the model-free complexity score.
• Every non-text capability defaults to false and must be independently enabled after its adapter, bounds, accounting, and parity gates pass.
• The current gateway remains text-only; known modality-shaped fields fail closed before access/provider delivery.
• Batch persistence and reconciliation are intentionally deferred to the batch-specific follow-up slice.

User-Facing Contract

CLI / Human Output

No CLI commands or exit codes change in this slice.

JSON Output

Known unsupported modality payloads receive HTTP 400 with error type wayfinder_router_unsupported_modality and the normal bounded request-id metadata. Ordinary text Chat Completions and Responses requests remain unchanged.

Exit Codes

No CLI exit-code changes.

Verification

Ran

• cargo fmt --manifest-path rust/Cargo.toml --all -- --check
• cargo +1.85.0 check --manifest-path rust/Cargo.toml --locked -p wayfinder-runtime-contracts -p wayfinder-routing-core -p wayfinder-apple-ffi -p wayfinder-gateway
• cargo clippy --manifest-path rust/Cargo.toml --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --manifest-path rust/Cargo.toml --workspace --all-targets --locked -q
• git diff --check

Covered

• Modality capability hard filters before scoring.
• FFI serialization and exclusion mapping.
• Nested modality detection with a bounded validation depth.
• Gateway rejection before a delivery implementation is called.
• Full workspace Rust tests: all suites passed (no failures).

Review Path

Stacked on PR #167 (codex/enterprise-responses-api); target that branch first, then rebase this PR onto main after #167 merges.

Notes For Reviewer

This is intentionally the smallest safe #154 slice. It creates the shared contract and fail-closed boundary without pretending that a generic OpenAI-shaped endpoint is a qualified embeddings, image, audio, or batch adapter. The four execution surfaces should land as independent follow-up PRs with their own bounds, usage/cost, concurrency/deadline, persistence (where applicable), and parity evidence.