feat(fpagent): show scanner availability and gate capture

Consume fpagent's fprint-device-status {available, device, captureAgentId}
in the /fingerprint wizard. Availability is tracked tri-state so an agent
that does not report it leaves capture working as before; the header tag
shows offline / no-scanner / ready, the capture panel warns, and capture is
disabled until a supported reader is attached.

Adds a vm-sandbox test for the wizard logic and the OpenSpec change
fpagent-device-availability, archived with the fingerprint-wizard spec.

README.md

@@ -152,6 +152,12 @@ The `/fingerprint` wizard walks the operator through:
    travel with every `fprint-enroll` to fpagent.
 3. **Save** — both templates are posted to a2loft with a fresh OTP.
 
+The wizard tracks fpagent's scanner availability: the header tag and the capture
+panel show when the agent is offline or no reader is attached, and capture is
+disabled until a supported reader is detected. Availability means the reader is
+attached, not that a capture will succeed; enrolling still fails if the scanner
+is claimed or a scan does not complete.
+
 ### Installing the agent
 
 `/fpagent/install.sh` is a public installer (also served for `curl | bash`). It