Inspect the context before a security agent runs

A tenant-boundary defect shows Distill in use: locked inputs, inspectable manifests, repeatable builds, and explicit integrity failures.