Function check_security 

pub fn check_security(program: &Program, diags: &mut Diagnostics)

Run §3.5’s checks over a placed program.

Split in two because the two halves have different scopes, which multi-module compilation made visible and single-file compilation could not:

• Boundaries are a property of one module’s types and placements. A module that puts a secret in something the client subscribes to is wrong on its own terms, and should be told so without waiting for whatever imports it.
• Capability discharge is a property of the whole program, because the chokepoint is one decide node and it lives wherever the wiring lives. A policy module holding cap.session is not an error; it is a policy module. It becomes an error only if, once linked, nothing reaches it from the validator.

Running the second per module reported every correctly-factored authority module as a violation — which is how this distinction was found.