Adds boot-time check that every manifest-declared use case is bound through withSpan (__instrumented) + withCapture (__captured), with withAudit (__audited) enforced when audits[] is non-empty. Propagates inner brands through withSpan so the outermost container-resolved binding carries all brand markers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>