API capability pack for bounded Segment Public API v1 operations against https://api.segmentapis.com only, using the published Segment OpenAPI/SDK version 73.0.0. Enroll a Segment Public API token connection named segment as bearer auth; no credential is embedded in the manifest. The pack reads workspace identity, sources, destinations, warehouses, tracking plans, tracking-plan rules, labels, source schema settings, connected destinations/warehouses, audit events, event volume, API-call usage, and MTU usage. It supports approval-gated governance writes for creating/updating tracking plans, adding a source to a tracking plan, replacing/upserting tracking-plan rules, creating labels, and adding labels to a source. It intentionally excludes source/destination/warehouse creation or credential mutation, destination subscriptions, user/group/IAM administration, regulations and suppression APIs, write-key creation/removal, live plugins, selective sync writes, delete operations, EU endpoint switching, and arbitrary API passthrough.