Value-free :telemetry.span/3 wrapper. Owns the metadata allowlist — the single enforcement point for "no row values in telemetry" (Critical Rule 1). LSNs, table names, counts, durations, and error classes are permitted; an off-allowlist key raises rather than shipping a value downstream. Mirrors arcadic's allowlist pattern.