feat(core-consent): scaffold package with types, IConsent, withConsent brand wrapper

- Add packages/core-consent with ConsentCategory, ConsentState,
  UserConsentState types and IConsent interface
- Add withConsent wrapper attaching __consentChecked brand at bind time;
  unit tests assert brand attachment and factory passthrough
- Add ConsentChecked<F> type to core-shared/conformance/brands.ts and
  isConsentChecked helper to brand-runtime.ts
- Extend FeatureManifest with requiresConsent?: readonly string[] field
- Extend assertFeatureConformance to require __consentChecked brand when
  requiresConsent.length > 0; synthetic fixture tests cover pass/fail cases
- Propagate __consentChecked in withSpan PROPAGATED_BRANDS so the outermost
  binding carries the brand

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-consent/AGENTS.md

@@ -0,0 +1,29 @@
+# @repo/core-consent
+
+Optional core package providing a vendor-neutral consent management interface. Scaffold via `pnpm turbo gen core-package consent` (once the generator supports it).
+
+## Structure
+
+```
+src/
+  consent-types.ts        # ConsentCategory, ConsentState, UserConsentState
+  consent.interface.ts    # IConsent — isGranted, grant, withdraw, getCategories
+  with-consent.ts         # withConsent wrapper attaching ConsentChecked brand
+  index.ts                # Barrel export
+```
+
+## Design
+
+`IConsent` exposes four methods:
+
+- `isGranted(category)` — synchronous check whether consent is granted
+- `grant(category)` — record consent grant for a category
+- `withdraw(category)` — record consent withdrawal for a category
+- `getCategories()` — list all known consent states
+
+The interface is vendor-neutral: no storage implementation is bundled here. Concrete implementations (e.g. a Payload-backed store) are wired at DI bind time in `bind-production` (Story 04).
+
+`withConsent` wraps a use-case factory at bind time, attaches the `__consentChecked` brand, and is the innermost wrapper in the composition chain:
+`withSpan → withCapture → withAudit → withAnalytics → withConsent → factory(deps)`
+
+See `docs/architecture/agent-first-workflow-and-conformance.md` for the dependency-injection conventions.