> I don't understand how this can be enforced without ridiculous levels of false positives.

It's embarrassingly trivial, IMO - compare what antigravity reports for token to what the backend reports for token usage for that user.