Bounded verification of capability-driven action visibility.

It proves that combining target decisions with host policy always selects the more restrictive status, so stricter policy cannot reveal an action.