feat(instrumentation): close R44 gap — throw-site capture for use cases + controllers

Plan 10 documented R44 (capture at originating-throw layer) but only the
R43 repo leg was wired. captureException had zero call sites in any
controller or use-case body. This commit closes the gap.

Mechanism:
- Extract __sentryReported flag helpers into core-shared/instrumentation/
  reported-flag.ts. SentryLogger switches to importing them; RecordingLogger
  carries an inlined copy (tooling → core boundary disallows the import).
- Add withCapture(logger, tags, fn) higher-order wrapper paralleling
  withSpan. On throw: capture-with-tags, mark, re-throw. Bail if the flag
  was already set — covers the bubbled-from-repo case so each error
  surfaces in the logger exactly once with the inner-most layer's tags.
- Apply withSpan(withCapture(factory)) in every feature's bind-production
  and bind-dev-seed: auth (3 use cases × 3 controllers), blog (3×3),
  marketing-pages (2×2), navigation (1×1), media (3×3). Span is outermost
  so the errored span timing reflects the capture-and-rethrow.
- RecordingLogger.captureException now also honours the flag — test
  capture counts stay honest when both repo and outer layer wrap.

Tests:
- packages/core-shared/src/instrumentation/with-capture.test.ts —
  4 cases covering success, capture-on-throw, mark-on-capture, no-double
  via the flag.
- packages/blog/tests/r44-no-double-capture.test.ts — 3 cases: repo throw
  → 1 capture with repo tags; controller parse fail → 1 capture with
  controller tags; success → 0 captures.

Verification: pnpm test 26/26, pnpm lint 15/15, pnpm typecheck 14/14.

Docs: ADR-014 and the refactor log gain a "Post-merge follow-up" section
recording the gap, the fix, and the underlying lesson (don't describe
intent as shipped state — grep first).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/auth/src/di/bind-dev-seed.ts

@@ -1,5 +1,6 @@
 import {
   withSpan,
+  withCapture,
   INSTRUMENTATION_SYMBOLS,
   type ITracer,
   type ILogger,
@@ -61,17 +62,29 @@ export async function bindDevSeedAuth(tracer: ITracer, logger: ILogger): Promise
   const wrappedSignIn = withSpan(
     tracer,
     { name: "auth.signIn", op: "use-case" },
-    signInUseCase(repo, authService),
+    withCapture(
+      logger,
+      { feature: "auth", layer: "use-case", name: "auth.signIn" },
+      signInUseCase(repo, authService),
+    ),
   );
   const wrappedSignUp = withSpan(
     tracer,
     { name: "auth.signUp", op: "use-case" },
-    signUpUseCase(repo, authService),
+    withCapture(
+      logger,
+      { feature: "auth", layer: "use-case", name: "auth.signUp" },
+      signUpUseCase(repo, authService),
+    ),
   );
   const wrappedSignOut = withSpan(
     tracer,
     { name: "auth.signOut", op: "use-case" },
-    signOutUseCase(authService),
+    withCapture(
+      logger,
+      { feature: "auth", layer: "use-case", name: "auth.signOut" },
+      signOutUseCase(authService),
+    ),
   );
 
   for (const sym of [
@@ -94,7 +107,11 @@ export async function bindDevSeedAuth(tracer: ITracer, logger: ILogger): Promise
       withSpan(
         tracer,
         { name: "auth.signIn", op: "controller" },
-        signInController(wrappedSignIn),
+        withCapture(
+          logger,
+          { feature: "auth", layer: "controller", name: "auth.signIn" },
+          signInController(wrappedSignIn),
+        ),
       ),
     );
   authContainer
@@ -103,7 +120,11 @@ export async function bindDevSeedAuth(tracer: ITracer, logger: ILogger): Promise
       withSpan(
         tracer,
         { name: "auth.signUp", op: "controller" },
-        signUpController(wrappedSignUp),
+        withCapture(
+          logger,
+          { feature: "auth", layer: "controller", name: "auth.signUp" },
+          signUpController(wrappedSignUp),
+        ),
       ),
     );
   authContainer
@@ -112,7 +133,11 @@ export async function bindDevSeedAuth(tracer: ITracer, logger: ILogger): Promise
       withSpan(
         tracer,
         { name: "auth.signOut", op: "controller" },
-        signOutController(wrappedSignOut),
+        withCapture(
+          logger,
+          { feature: "auth", layer: "controller", name: "auth.signOut" },
+          signOutController(wrappedSignOut),
+        ),
       ),
     );
 }

packages/auth/src/di/bind-production.ts

@@ -1,6 +1,7 @@
 import type { SanitizedConfig } from "payload";
 import {
   withSpan,
+  withCapture,
   INSTRUMENTATION_SYMBOLS,
   type ITracer,
   type ILogger,
@@ -53,21 +54,33 @@ export function bindProductionAuth(
     .bind<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService)
     .toConstantValue(authService);
 
-  // Use cases — wrapped with span at bind time
+  // Use cases — wrapped with span + capture at bind time
   const wrappedSignIn = withSpan(
     tracer,
     { name: "auth.signIn", op: "use-case" },
-    signInUseCase(repo, authService),
+    withCapture(
+      logger,
+      { feature: "auth", layer: "use-case", name: "auth.signIn" },
+      signInUseCase(repo, authService),
+    ),
   );
   const wrappedSignUp = withSpan(
     tracer,
     { name: "auth.signUp", op: "use-case" },
-    signUpUseCase(repo, authService),
+    withCapture(
+      logger,
+      { feature: "auth", layer: "use-case", name: "auth.signUp" },
+      signUpUseCase(repo, authService),
+    ),
   );
   const wrappedSignOut = withSpan(
     tracer,
     { name: "auth.signOut", op: "use-case" },
-    signOutUseCase(authService),
+    withCapture(
+      logger,
+      { feature: "auth", layer: "use-case", name: "auth.signOut" },
+      signOutUseCase(authService),
+    ),
   );
 
   for (const sym of [
@@ -95,7 +108,11 @@ export function bindProductionAuth(
       withSpan(
         tracer,
         { name: "auth.signIn", op: "controller" },
-        signInController(wrappedSignIn),
+        withCapture(
+          logger,
+          { feature: "auth", layer: "controller", name: "auth.signIn" },
+          signInController(wrappedSignIn),
+        ),
       ),
     );
   authContainer
@@ -104,7 +121,11 @@ export function bindProductionAuth(
       withSpan(
         tracer,
         { name: "auth.signUp", op: "controller" },
-        signUpController(wrappedSignUp),
+        withCapture(
+          logger,
+          { feature: "auth", layer: "controller", name: "auth.signUp" },
+          signUpController(wrappedSignUp),
+        ),
       ),
     );
   authContainer
@@ -113,7 +134,11 @@ export function bindProductionAuth(
       withSpan(
         tracer,
         { name: "auth.signOut", op: "controller" },
-        signOutController(wrappedSignOut),
+        withCapture(
+          logger,
+          { feature: "auth", layer: "controller", name: "auth.signOut" },
+          signOutController(wrappedSignOut),
+        ),
       ),
     );
 }