feat(core-shared/conformance): assertFeatureConformance helper

Adds boot-time check that every manifest-declared use case is bound
through withSpan (__instrumented) + withCapture (__captured), with
withAudit (__audited) enforced when audits[] is non-empty. Propagates
inner brands through withSpan so the outermost container-resolved
binding carries all brand markers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/src/instrumentation/with-span.ts

@@ -2,6 +2,8 @@ import type { ITracer, SpanOpts } from "./tracer.interface";
 import type { Instrumented } from "../conformance/brands";
 import { attachBrand } from "../conformance/brand-runtime";
 
+const PROPAGATED_BRANDS = ["__captured", "__audited"] as const;
+
 export function withSpan<Args extends unknown[], R, Extra extends object>(
   tracer: ITracer,
   opts: SpanOpts | ((args: Args) => SpanOpts),
@@ -22,6 +24,15 @@ export function withSpan<Args extends unknown[], R>(
     return tracer.startSpan(resolved, () => fn(...args));
   };
   attachBrand(wrapped, "__instrumented");
+  // Propagate brands from the inner function (e.g. __captured from withCapture,
+  // __audited from withAudit) so the outermost binding carries all brands.
+  // withSpan is always outermost — the assertFeatureConformance check reads the
+  // container-resolved value (the withSpan result), so brands must be visible here.
+  for (const brand of PROPAGATED_BRANDS) {
+    if ((fn as unknown as Record<string, unknown>)[brand] === true) {
+      attachBrand(wrapped, brand);
+    }
+  }
   // Cast is the type-level concession — the brand is now also a non-enumerable
   // runtime property attached above by `attachBrand`.
   return wrapped as Instrumented<(...args: Args) => Promise<R>>;