Store best practices

Pin published Capability / MCP bindings in production. Do not rely on draft releases.

Scope API Keys with Capability grants. Monitor tool_key, capability_id, task_id, and latency in Console logs.