Fix git paths in CEO heartbeat sync and add capabilities to PATCH

- Fixed /paperclip/privilegedescalation → /paperclip/privilegedescalation/agents
- Added capabilities as top-level PATCH field in sync step

Co-Authored-By: Paperclip <noreply@paperclip.ing>

ceo/HEARTBEAT.md

@@ -74,16 +74,16 @@ This repo (`/paperclip/privilegedescalation/agents`) is the canonical source of
 #### 5a. Authenticate with GitHub and pull latest
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
-    git -C /paperclip/privilegedescalation pull origin main
+    git -C /paperclip/privilegedescalation/agents pull origin main
 
 #### 5b. Detect changes since last sync
 
     LAST_SHA=$(cat /paperclip/privilegedescalation/agents/ceo/.last-synced-sha 2>/dev/null || echo "")
-    CURRENT_SHA=$(git -C /paperclip/privilegedescalation rev-parse HEAD)
+    CURRENT_SHA=$(git -C /paperclip/privilegedescalation/agents rev-parse HEAD)
 
 If `LAST_SHA` is empty or equals `CURRENT_SHA`, skip to step 5. Otherwise:
 
-    git -C /paperclip/privilegedescalation diff "$LAST_SHA".."$CURRENT_SHA" --name-only
+    git -C /paperclip/privilegedescalation/agents diff "$LAST_SHA".."$CURRENT_SHA" --name-only
 
 #### 5c. Apply config changes for each affected agent
 
@@ -105,7 +105,9 @@ For each agent whose files changed in the diff:
           -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
           -H "Content-Type: application/json" \
           -H "X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID" \
-          -d '{"adapterConfig": {MERGED_OBJECT}, "runtimeConfig": {"heartbeat": {FROM_CONFIG_MD}}}'
+          -d '{"adapterConfig": {MERGED_OBJECT}, "runtimeConfig": {"heartbeat": {FROM_CONFIG_MD}}, "capabilities": "{FROM_CONFIG_MD_CAPABILITIES}"}'
+
+6. If the `CONFIG.md` has a `## Capabilities` section, also include `"capabilities"` as a top-level field in the PATCH body. This is a separate field from `adapterConfig`.
 
 **Safety rules for the merge:**