Unexport LINUX_CAPABILITY_MAP from capability-filter.ts (#7928)

* Initial plan

* fix: unexport LINUX_CAPABILITY_MAP, expose via testHelpers

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot

src/capability-filter.test.ts

@@ -6,8 +6,10 @@ import {
   isCapDropSkipped,
   filterCapDrop,
   filterComposeCapDrop,
-  LINUX_CAPABILITY_MAP,
+  testHelpers,
 } from './capability-filter';
+
+const { LINUX_CAPABILITY_MAP } = testHelpers;
 import { DockerComposeConfig } from './types';
 import { generateDockerCompose } from './compose-generator';
 import { WrapperConfig } from './types';

src/capability-filter.ts

@@ -7,7 +7,7 @@ import { getLocalDockerEnv } from './docker-host';
  * Map of standard Linux capability names (uppercase, without CAP_ prefix) to bit positions in CapBnd.
  * Reference: Linux kernel include/uapi/linux/capability.h
  */
-export const LINUX_CAPABILITY_MAP: Record<string, number> = {
+const LINUX_CAPABILITY_MAP: Record<string, number> = {
   CHOWN: 0,
   DAC_OVERRIDE: 1,
   DAC_READ_SEARCH: 2,
@@ -164,3 +164,7 @@ export function filterComposeCapDrop(
   }
   return composeConfig;
 }
+
+/** @internal Exposed for unit tests only. */
+// ts-prune-ignore-next
+export const testHelpers = { LINUX_CAPABILITY_MAP };