A second-level domain's capability catalog lives in its provider

ADR-073 gave a bond one extension point: `capabilities`, typed as 'reference ids into the