refactor: capabilities - add unified launch routine

programs/src/shell/exec.cpp

@@ -41,17 +41,8 @@ static void print_exit_code(int code) {
 
 static bool try_exec(const char* path, const char* args) {
     if (!file_exists(path)) return false;
-    // Least-privilege hygiene, NOT a security boundary: this never decides
-    // what may run, only which capabilities a tool receives.  The user in an
-    // admin console can already do everything these tools do, so the point is
-    // to keep a bug in one tool from reaching authority it has no use for.
-    // The shell delegates on the same terms as the desktop; the table decides
-    // per binary, and the kernel re-checks the bound on every spawn.
-    montauk::abi::SpawnCapabilities caps =
-        montauk::caps::for_binary(path, shell_delegable_caps);
-    int pid = (caps.permitted != 0)
-        ? montauk::spawn_with_caps(path, args, nullptr, caps)
-        : montauk::spawn(path, args);
+    
+    int pid = montauk::caps::launch(path, {.args = args});
     if (pid < 0) return false;
     print_exit_code(montauk::waitpid(pid));
     return true;