Combined guard: check version gate first, then capability. Short-circuits on version failure (skip capability probe if binary might not have it).
Optional
Combined guard: check version gate first, then capability. Short-circuits on version failure (skip capability probe if binary might not have it).