Add wall-clock and currency ceilings to hard admission budgets

[4nass]

Context

This is the remaining limit type from #27. Token and call reservations are delivered in core/jobs/budget.py, but an unattended run can still consume unbounded wall-clock time and there is no currency ceiling when a provider reports a price.

Acceptance criteria

• Projects or budget classes can declare max elapsed run time and max stage time.
• The scheduler enforces the time ceiling before dispatch and while a provider call is running.
• A time limit produces a deterministic interrupted or waiting_approval outcome and cleans up child processes/worktrees safely.
• Currency limits are enforced when a provider reports cost, with an explicit fail-safe policy when cost is unknown.
• Reservations and settlements include token, call, elapsed-time and currency dimensions.
• Existing soft/strict/local_fallback semantics remain explicit and covered by regression tests.
• Reports and telemetry show reserved, consumed, remaining and the policy decision for every dimension.
• Concurrent jobs cannot each admit a call that exceeds the aggregate budget.

Relationship

Parent: #27. The token/call gate, heuristic token estimation and local_fallback wait behavior are already delivered. Do not duplicate or weaken that implementation.

[4nass]

Delivery update

Implemented in PR #56:

• hard reservations for tokens, calls, elapsed seconds and USD;
• pre-dispatch admission and concurrent reservation enforcement;
• settlement validation and fail-closed behavior when provider cost is unknown in strict or local_fallback modes;
• provider deadlines propagated to Claude, Codex CLI and Anthropic adapters;
• reports and documentation for reserved, consumed and remaining dimensions.

Validation: 794 tests passed, with two pre-existing collection warnings.

Residual: review and merge are still required, followed by environment-specific price and ceiling calibration. Providers without a cost estimate must use soft mode or an explicit pre-call estimate.