Idea: Pass the singleton setup token to main()

Right now, it seems like a program that calls begin_setup() after end_setup() would still compile. Would it be possible to get rid of begin_setup() and just the token as an argument to main? That way there would be no way to get another one after it's been dropped.

The issue names begin_setup(), end_setup(), and main(), but no files or tests. Start by locating those definitions and their call sites, then clarify the intended setup-token lifecycle and how completion should be verified.

Written by the indexing model from the issue text.