Capability-safe Rust runtime for model-backed apps — scoped operations, durable facts, r…