[AT]: Respect capability validity windows during SDK selection

[itsyaasir]

Feature description

Make the Rust SDK capability auto-selection respect valid_from and valid_until when choosing a capability for an operation.

Motivation

The SDK currently selects capabilities by role membership only. If an owner has multiple matching capabilities and one is expired, the SDK can pick the expired one first, causing a valid operation to fail even though a usable capability exists. Move enforces the validity window on-chain, so the SDK should prefilter candidates the same way.

Requirements

1. When auto-selecting a capability, ignore capabilities whose valid_from/valid_until window is not currently valid.
2. Apply the same filtering to the generic selector and the tag-aware record selector.
3. Return a clear error only when no currently valid matching capability exists.
4. Add regression tests covering multiple matching capabilities where one is expired and another is valid.

Open questions

Should SDK selection prefer the capability with the latest valid_until when multiple currently valid capabilities match?

Are you planning to do it yourself in a pull request?

Yes