Teams capability grants accept negative spend and reduce daily cap accounting

Reproduction steps:

1. Create a Team capability grant with max_spend_cents_per_day=100.
2. Use the grant with a valid capability_use_request spending 100 cents.
3. Send another valid capability_use_request with spend_cents=-100.
4. Send a third valid request spending 100 cents.
5. Use a harmless mock executor and inspect the holder-side share_spend.json counter.

Expected:
Negative spend must be rejected before the executor runs. A daily spend counter must never decrease.

Actual:
The holder executor is called for spend_cents=-100. The counter changes from 100 to 0, and the third 100-cent request is accepted. The normal positive overspend predicate still rejects a request whose cumulative spend exceeds 100.

Station version (railcall version): station-v0.68
Module slug + version: Not module-specific; Teams capability path

Root cause:
workbench/primitives/team_share.py::handle_use_request() converts spend_cents with int() and checks only spent + spend > cap. There is no validation that spend_cents is >= 0 before execution or _record_spend().

Impact:
The platform's daily capability spend accounting can be reduced by a valid Team operator request, allowing further requests after the cap should have been reached. This ticket claims the reproduced accounting/executor bypass only; no live provider request was made.

Deterministic: Yes.
External provider contacted: No; reproduction uses the injected mock executor.