feat(town): add deterministic capability testing support

Description

The pitch.

## Problem

Town needs a deterministic, real execution seam before an external agent can be evaluated through the simulator without coupling generic scenario code to the agent-test feature.

## Change

- add the pinned capability workflow used by the test profile
- resolve the reference Registry explicitly for the run
- support per-run participant injection through the generic scenario boundary
- keep ordinary `nest run capability_fulfillment` behavior unchanged

## Verification

- final stack: `make ci-local` — all 5 checks passed; 2,081 passed, 2 skipped, 1 deselected
- generic ScenarioRunner compatibility and ordinary capability workflow smoke are covered
- independent architecture review found no Critical or Important issues

## Stack

**1 of 9 — review this PR first.** Each PR targets the preceding branch.

1. #220 — deterministic Town seam
2. #221 — version 1 contracts and profile
3. #222 — hardened loopback driver
4. #223 — evaluation engine and artifacts
5. #224 — local-adapter CLI and reference journey
6. #225 — shared local adapter server
7. #226 — bounded OpenClaw connector
8. #227 — managed-runtime Town bridge
9. #228 — one-command OpenClaw CLI and docs

**Merge note:** Merge this PR into `main` first. Then retarget #221 to `main`, wait for its CI, and continue one PR at a time.