API capability pack for bounded Fly.io Machines REST API calls against https://api.machines.dev/v1 only. Reads current token metadata, apps, machines, machine events, process lists, machine memory, machine metadata, machine versions, volumes, snapshots, IP assignments, TLS certificates, organization-wide machine/volume inventories, and platform regions. Approval-gated writes are limited to creating one app, creating or extending one volume, creating one volume snapshot, requesting or re-checking one ACME certificate, creating one machine, and single-machine lifecycle actions: start, stop, restart, cordon, uncordon, or suspend. Enroll a Fly.io API-token bearer connection named flyio. The pack intentionally excludes app/machine/volume/certificate deletes, raw command execution, arbitrary signals, secret and secret-key value reads/writes, deploy-token creation, KMS/OIDC token minting, token authorization endpoints, custom certificate upload, IP assignment mutation, and arbitrary API passthrough.