Refactor capability table to copy-on-write

Refactor capability table to copy-on-write. The escrow accepts the merge cert only when the gitlawb oracle quorum signs a certificate proving that a PR resolving #418 landed on main.

• Tests must stay green on the target branch after merge.
• No new direct dependencies without justification in the PR body.
• If race-eligible, the first valid merge wins; honest losers refunded gas.