operations: enforce community capability limits

crates/crank-registry/src/migrations.rs

@@ -198,6 +198,7 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
             display_name text not null,
             category text not null default 'general',
             protocol text not null,
+            security_level text not null default 'standard',
             status text not null,
             current_draft_version integer not null default 1,
             latest_published_version integer null,
@@ -217,6 +218,11 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
     )
     .execute(pool)
     .await?;
+    query(
+        "alter table operations add column if not exists security_level text not null default 'standard'",
+    )
+    .execute(pool)
+    .await?;
     query("update operations set workspace_id = 'ws_default' where workspace_id is null")
         .execute(pool)
         .await?;