[OPER-QA-17] Agent capability catalog — (agentWorkerId, testKind) eligibility rows

feature_id: FEAT-studio-qa-projects
verify_cmd: pnpm --filter @operant/database migrate:test && pnpm --filter @operant/qa test capability

## Context

The QA schema (packages/database/prisma/schema/qa.prisma) has no notion of which agent worker is eligible for which `TestKind`. Without a catalog, the OPER-QA-16 resolver has no principled way to decide whether an agent member should receive a given case: it would either fan out to every agent for every kind (wrong), or hard-code eligibility (worse).

Add a minimal, forward-compatible catalog:

- One row per `(agentWorkerId, testKind)` — the resolver reads this and skips cases an agent isn't eligible for.
- No PHI, no per-tenant scoping in the catalog itself (agent eligibility is a fleet-wide fact about the agent worker); tenancy is enforced at the resolver by walking through team-scoped `QaTestProject` → `QaTestProjectMember` → agent.
- `enabled: Boolean` so a capability can be quiesced without deleting the row (preserves audit trail on why an agent stopped picking up a kind).
- Optional `notes String?` for the human who registered it.

References:
- packages/database/prisma/schema/tasks.prisma:430 — `AgentWorker`
- packages/database/prisma/schema/qa.prisma:317 — `enum TestKind`
- OPER-QA-16 (this batch) — the consumer

## Acceptance Criteria

- [ ] New `AgentCapability` model in the correct `.prisma` file (likely `qa.prisma` alongside the other QA models; `schema-guard` to confirm placement).
- [ ] Fields: `id cuid`, `agentWorkerId String` (FK → AgentWorker.id, cascade on delete), `testKind TestKind`, `enabled Boolean @default(true)`, `notes String? @db.Text`, `createdAt`, `updatedAt`.
- [ ] `@@unique([agentWorkerId, testKind])` and `@@index([testKind, enabled])`.
- [ ] Non-destructive migration; documented rollback.
- [ ] Seeded for existing registered agent workers as part of the migration (or an idempotent seed script) so OPER-QA-16 doesn't ship into an empty catalog.
- [ ] `phi-auditor` clean (no PHI annotations required — this table is fleet metadata).
- [ ] `schema-guard` and `rls-guard` clean.
- [ ] Depended on by OPER-QA-16 (blocks that ticket's resolver test).
- [ ] Body carries `verify_cmd: pnpm --filter @operant/database migrate:test && pnpm --filter @operant/qa test capability` frontmatter.

verify_cmd: pnpm --filter @operant/database migrate:test && pnpm --filter @operant/qa test capability