An unguessable capability URL is the whole credential (closes #52)
needs-review
check / check (push) Successful in 16s
Milestone next: check-cache busting, build-context hygiene, lint in a container
merge-ready
check / check (push) Successful in 5m12s