on-workload-bind

A workload importing one of this plugin's exported capabilities is being bound. Runs to completion before any capability call from that workload is delivered. Returning an error rejects the bind and the workload fails to deploy.

MUST be idempotent: after a plugin restart the host replays a bind for every workload still bound, so the fresh incarnation can rebuild its per-workload state before serving.