feat(capabilities): bind operationId for API-surface capability records

Records with an api surface but no operationId cannot be attested against the
implementation (doctor CAP-OPID-MISSING). Each operationId here is taken verbatim
from this repo's own contract file and matches the capability one-to-one; no
operationId was guessed.

siax/capabilities/0pt.order_create.json

@@ -12,5 +12,6 @@
   ],
   "requiresJob": true,
   "tenantScoped": true,
+  "operationId": "0pt.create_order",
   "description": "Risk tilldelad av RW-005b-regel (L3/low): Produktionsmutation av data (RAG-003 reg 1) — övervakning krävs. RAG-003-RISK-TAXONOMY + siax-tenancy deny-by-default."
 }

siax/capabilities/0pt.query_source.json

@@ -12,5 +12,6 @@
   ],
   "requiresJob": true,
   "tenantScoped": true,
+  "operationId": "0pt.query_source",
   "description": "Risk tilldelad av RW-005b-regel (L2/none): Läsande/beräknande — ingen mutation, begränsad påverkan. RAG-003-RISK-TAXONOMY + siax-tenancy deny-by-default."
 }