Add run-time checks for validating variable scoping

[danmatichuk]

In cases where we need to coerce one variable scope into another, we don't have enough static information to prove that this is safe (i.e. that the bound variables in the value respect the target scope). As an additional sanity check, we can add an (optional) run-time check that validates the scoping invariant after a coercion.