Enforce rendered-command provenance with lint, and correct what the brand claims

[tobyhede]

Parent

#799. Design record: .scratch/render-execution-unit/spec.md — read the brand-tier section; it explains why a type-level brand is the right tier here and what it does not prove.

What to build

Make the rendered-command provenance guarantee enforceable rather than conventional.

The brand marks text as having come from the entry seam. Two gaps make that a convention: a direct cast satisfies it, and the restriction otherwise lives in a barrel export list that nothing checks.

Close both with the pattern this repo already uses for trusted artifact records — ban the cast by AST selector and exempt the sanctioned producer by file, and restrict imports of the three expansion functions to the one module allowed to call them. All three have exactly one production caller today, and the entry-seam work deletes it, so the restriction costs nothing.

Also correct the claim being enforced. The brand witnesses provenance, not how many times a value was produced; two calls to the seam mint two valid values. Name and document it for what it proves, and leave single-entry to the existing call-count assertions.

Acceptance criteria

• A direct cast to the branded type is a lint error outside the producer, and the rule blocks verify.
• The expansion functions cannot be imported outside the allow-listed module.
• The brand is applied to a record rather than a bare string, so a runtime brand stays available if it is ever needed.
• TSDoc states the provenance guarantee and explicitly does not claim exactly-once.
• The stale rationale about manifest rows is removed rather than carried forward — see the spec.

Blocked by

• Introduce the core entry seam; the execution loop becomes its only caller #819