fix: guard capabilities import in agent for stripped-host degradation

Matches the agent's established try/except import convention; the
agent now starts and reports empty capabilities when utils.capabilities
(or its dependency chain) is unavailable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

intercept_agent.py

@@ -43,8 +43,13 @@ except ImportError:
     HAS_DEPENDENCIES_MODULE = False
 
 # Shared capability detection (extracted so app and agent cannot drift)
+try:
     from utils.capabilities import MODE_DEPENDENCY_MAP, detect_interfaces, detect_mode_availability
 
+    HAS_CAPABILITIES_MODULE = True
+except ImportError:
+    HAS_CAPABILITIES_MODULE = False
+
 # Import TSCM modules for consistent analysis (same as local mode)
 try:
     from utils.tscm.correlation import CorrelationEngine
@@ -420,12 +425,20 @@ class ModeManager:
             "tool_details": {},  # Detailed tool status
         }
 
+        if not HAS_CAPABILITIES_MODULE:
+            # Degrade gracefully on stripped-down hosts where utils.capabilities
+            # (or its dependency chain) could not be imported.
+            logger.warning("capability detection unavailable: utils.capabilities could not be imported")
+        else:
             # Detect interfaces via shared capability detection
             capabilities["interfaces"] = detect_interfaces()
 
             # Probe dependencies once; reuse for both mode availability and tool_details.
+            # Note: utils.capabilities imports check_all_dependencies at module level, so if
+            # utils.dependencies were missing, the capabilities import would have failed and
+            # HAS_CAPABILITIES_MODULE would be False. Inside this True branch, HAS_DEPENDENCIES_MODULE
+            # is therefore necessarily True as well — the inner guard is not needed.
             dep_status: dict | None = None
-        if HAS_DEPENDENCIES_MODULE:
             try:
                 dep_status = check_all_dependencies()
             except Exception as e: