Make native Ubuntu host assumptions explicit and capability-checked

[defangdevs]

Problem

The native renderer and applicator assume an Ubuntu-like host across apt policy, service names, system paths, systemd features, and the Determinate Nix installation, but those assumptions are discovered piecemeal while applying changes.

This makes a missing required capability look like an arbitrary command failure and lets optional policy silently become inert. #467 is a concrete example: the empty-root fixture says the Nix store thresholds are installed, while the real Determinate-owned file causes the native policy to be skipped.

The original portability work discussed broader native distributions, but Ubuntu is the implementation that exists today. That support boundary should be explicit.

Proposed direction

Introduce a native host/capability object resolved once before rendering or mutation. It should include:

• distro ID and supported version range from /etc/os-release;
• required executables and systemd capabilities;
• package/update-policy mechanism;
• important pre-existing ownership, such as Determinate-managed Nix configuration;
• optional capabilities with precise advisory failure behavior.

Keep Ubuntu as the first-class native target. Unsupported distributions should fail early with a clear message or require an explicit opt-in, rather than partially receiving Ubuntu configuration.

Inject the capability object into rendering and execution so tests can model realistic hosts without constructing an empty fake root.

Acceptance criteria

• Supported Ubuntu versions and required host capabilities are declared in one place.
• Missing required capabilities fail before partial apply.
• Optional capability absence produces a visible, structured advisory.
• Tests include realistic pre-existing distro/installer-owned files, including the agentbox apply never sets nix min-free/max-free: the Determinate installer already owns nix.custom.conf #467 shape.
• No claim of RHEL or arbitrary Linux support is made without a corresponding host adapter and test fixture.
• NixOS may adopt the capability vocabulary later, but is not required for the native implementation.