Function validate_binding 

pub fn validate_binding(
    resolved: &ResolvedBinding,
) -> Result<(), Vec<CapabilityError>>

Validate a resolved binding against the medium-capability matrix (D6), returning every capability refusal (empty Err never returned — Ok means clean). Generalizes the render-time preparation refusal to binding-validation time.

Refuses, per D6:

• a declared sync / verify operation over a web medium (CapabilityError::OperationOutOfScope);
• a glob deny_paths list over a non-path-namespace medium (CapabilityError::GlobDenyIllegal);
• any declared facet preparation (CapabilityError::PreparationUnsupported);
• a prune block requesting never-clobber over a non-base-retrievable medium (CapabilityError::PruneGuaranteeUnsupported, F1).

A binding whose every declared operation the matrix marks legal validates clean (Ok(())). This is a new, callable entry point — it is not yet wired into the live loader / resolve path.