API capability pack for bounded Heroku Platform API operations against https://api.heroku.com only. Enroll a Heroku OAuth or API-token bearer connection named heroku; no credential is embedded in this manifest. The pack reads account metadata, apps, dynos, formations, releases, builds, domains, pipelines, pipeline couplings, teams, spaces, regions, stacks, dyno sizes, and app add-on inventory for deployment operations, runtime investigation, release readiness, rollback review, and infrastructure inventory. Approval-gated writes are limited to creating one app, creating one build from one source blob URL, canceling one build, creating one domain, restarting or stopping selected dynos/formations, scaling one formation, and rolling back one release. The pack intentionally excludes app/domain/team/space/pipeline/add-on deletion, config-var value reads or writes, account mutation/deletion, billing and invoices, OAuth token/client/grant administration, SSH keys, team membership/invitations/permissions, add-on provisioning and plan mutation, private-space networking changes, log-session URL creation, log-drain mutation, app webhooks, ACM mutation, app transfer, arbitrary one-off dyno command creation, and arbitrary Heroku API passthrough.