Claims: facts are the one owner of a capability-free claim

Every shared capability needs a non-empty anyOf, so an empty fact set already
yields no capabilities; the explicit empty list beside it was a second owner
no test could tell apart from the first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/claims.ts

@@ -90,13 +90,13 @@ export async function issueAccessClaim(options: {
   const facts = withoutCapabilities
     ? []
     : normalizeFacts(options.input.accountId, options.input.linkedIdentities, options.input.facts);
-  const sharedCapabilities = withoutCapabilities
-    ? []
-    : evaluateSharedCapabilities(profile, {
-        accountId: options.input.accountId,
-        facts: new Set(facts),
-        identities: options.input.linkedIdentities,
-      });
+  // Every shared capability needs a non-empty anyOf (capability-rules), so an
+  // empty fact set yields no capabilities: facts are the one owner of that.
+  const sharedCapabilities = evaluateSharedCapabilities(profile, {
+    accountId: options.input.accountId,
+    facts: new Set(facts),
+    identities: options.input.linkedIdentities,
+  });
 
   const issuedAt = nowEpochSeconds();
   const ttlSeconds = clampTtlSeconds(