The control plane serves everything; the sidecar serves exactly the capabilities whose plane is data or both, plus the route-registered surfaces. Ask the data plane for a control-plane slug and it answers 404 by rule.
// the exact rule
const DATA_PLANE_SLUGS = new Set(capabilities.filter((c) => (c.plane ?? 'control') !== 'control').map((c) => c.slug));