fix: fail closed backend capabilities and isolate gate smoke

src/convex/status.ts

@@ -1,7 +1,7 @@
 import { queryGeneric } from "convex/server";
 import { v } from "convex/values";
 import { characterStateValidator } from "./schema";
-import { capabilityEnabled, parseCapabilityAllowlist } from "../lib/server/release-gate";
+import { capabilityEnabled, parseBackendCapabilityAllowlist } from "../lib/server/release-gate";
 
 const safeAssetSyncValidator = v.object({
   status: characterStateValidator,
@@ -27,7 +27,7 @@ function isUsableSession(session: any, timestamp = Date.now()): boolean {
 
 function deploymentCapabilityEnabled(capability: 'subscriptions'): boolean {
   try {
-    return capabilityEnabled(capability, parseCapabilityAllowlist(process.env.APP_CAPABILITY_ALLOWLIST));
+    return capabilityEnabled(capability, parseBackendCapabilityAllowlist(process.env.APP_CAPABILITY_ALLOWLIST));
   } catch {
     // A malformed backend setting must fail closed, not expose a reactive
     // tenant projection while the web process reports a configuration error.