Protect a capability path

Output contract: Collect every required choice explicitly; never infer or preselect; preserve errors, artifacts, and next actions. For suggested actions, pair Shell with the returned Copilot command; honor commandGuidance. If absent, say "Copilot: no verified equivalent"; never invent a slash command.

Boundary: no Story required; cwd=opened Git root or verified repositoryPath from singularity-flow workspace current --json; refuse if neither resolves; never search $HOME/parents.

1. Require one repository-relative path. Run singularity-flow capability show <PATH> --json.
2. Require an explicit approval group when the CLI cannot resolve exactly one.
3. After confirmation, run once:
   singularity-flow capability protect <PATH> --approver <GROUP> [--reason <TEXT>] --json.
4. Relay the exact review branch, commit, and receipt. Stop; never split the path rule from its approval, activate the proposal, or edit YAML.