Function capability_violations 

pub fn capability_violations(doc: &IntrospectDocument) -> Vec<String>

Assert capability self-consistency for every command in doc.

Returns one error message per offending command. Static repo-wide check that catches commands declaring an output mode without wiring the supporting schema metadata, or vice versa.

Per-mode rules (see also spec §3, §4, §8):

• OutputMode::None and OutputMode::LegacyJson MUST NOT carry schema refs.
• OutputMode::Envelope requires result_schema_ref; MUST NOT carry event_schema_ref or session_schema_ref.
• OutputMode::Stream requires event_schema_ref; implies long_running = true. result_schema_ref MAY also be set when the stream ends with a terminal envelope.
• OutputMode::Session requires session_schema_ref; implies stateful = true and long_running = true.

Per-field stem rules (spec §8): every present ref MUST take the exact shape foundry:<stem>@v<N> where <stem> is the emitting command’s command_id for result_schema_ref, the same id suffixed with .event for event_schema_ref, and .session for session_schema_ref. This makes payload/event/session schemas mechanically derivable from command_id so agents can pin against them without trusting the registry to map them.