Probe helper capabilities for a clear unsupported error

Before opening a stateless-connect session, dial now issues the remote helper's capabilities command and checks that stateless-connect is advertised. A helper that lacks it (e.g. one offering only the legacy connect capability) fails with an actionable error naming the helper and its advertised capabilities, instead of a cryptic mid-protocol failure. The probe is a local exchange — no network round trip happens until stateless-connect — so it adds no meaningful cost.