feat(client): activate ReadCap isolation via current identity + connections

Isolation was dormant (no current identity ever set). Now: setCurrentUser
records who is reading; declareConnections(neighborsOf) grants each protected
document's read cap to owner + connections. Reads discriminate through the
ReadCap filter: private→owner, protected→owner+connections, public→all. Generic
(the consumer injects identity + connections). Write-guard coverage limits
documented honestly in docs/simulation.md (real write paths bypass the JS proxy;
full enforcement awaits native caps). isolation-active.test.ts proves the
protected+connections path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/src/polyfill.ts

@@ -11,6 +11,7 @@
 import type { NgLike, UseShapeLike, PrincipalId } from "./types";
 import type { RegistrySession } from "./store-registry";
 import { CapRegistry } from "./caps";
+import type { Connections } from "./isolation";
 
 /**
  * Consumer-injected dependencies of the storeRegistry (polyfill-era). The
@@ -106,6 +107,22 @@ export function getCaps(): CapRegistry {
   return caps;
 }
 
+/**
+ * Declare the current session's CONNECTIONS to the SDK — the domain sharing act
+ * "a protected document is readable by its owner AND that owner's connections".
+ * The consumer knows who is connected to whom (its own social graph) and hands
+ * that graph to the SDK; the SDK issues the corresponding read access on every
+ * protected document it governs (public stays world-readable, private stays
+ * owner-only). Re-call whenever the connection graph changes.
+ *
+ * SDK-shaped: the consumer passes a {@link Connections} (who-is-connected-to-whom)
+ * and gets access enforcement — it never touches a document NURI, a store id, or
+ * the cap registry internals.
+ */
+export function declareConnections(connections: Connections): void {
+  caps.grantReadToConnections((owner) => connections.neighbors(owner));
+}
+
 /** Reset all emulated caps (mainly for tests / fresh sessions). */
 export function resetCaps(): void {
   caps = new CapRegistry();