refactor(pxe): migrate CapsuleStore to BaseStagingStore

[nchamo]

Summary

• Migrates CapsuleStore onto the BaseStagingStore, following refactor(pxe): migrate RecipientTaggingStore to BaseStagingStore #94 and refactor(pxe): migrate FactStore to BaseStagingStore #98. The base supplies the staging buffer, the operation lock and the commit/discard lifecycle; the Map<slot, Buffer | null> tombstone model carries over unchanged as the change set, and applyRollback is a no-op since capsules are not anchored to a block.
• setCapsule and deleteCapsule become async, since every base-store operation goes through withChangeSet. This ripples to CapsuleService and UtilityExecutionOracle; the oracle dispatcher already awaits handler results, so the Noir boundary is unaffected.
• Operations that read-modify-write an array (appendToCapsuleArray, setCapsuleArray, copyCapsule) no longer call the public setters from inside their own transaction, which would deadlock on the base's non-reentrant lock. They use private helpers instead, so each operation takes the lock exactly once.
• Behavior-preserving: the on-disk kv schema is byte-identical. Three store tests drop out: two are now base behavior, and one needed two change sets open at once, which the base forbids.