Tenant extensibility

Not covered: It stops at the model: what reaches the ExtensibilityService is CDL or CSN and i18n texts, and the annotations capire lists as affecting persistence or security, @impl, @restrict and @requires among them, are blocked unless the provider's extension-allowlist makes an exception. Without that allowlist no extension is accepted at all, and an extension the provider builds in advance and switches on per subscriber is a feature toggleFeature togglescapabilityTurning behaviour on and off per tenant or per user at runtime, without redeploying, and knowing which toggles are live. System-level switches for delivered objects and runtime flags for unfinished features share the name.SAP and community, narrow by design.