Merge "capabilities: Check ambient caps, last valid runtime cap."