feat(workflows): token + cost budgets across the run tree (B3, #2212)

[flora131]

Summary

Slice B3 of the run-budgets track (specs/2026-08-17-run-budgets.md §5.1 meter_run + §8 B3): token + cost budgets across the whole run tree.

• meter_run(tree, now) → RunMeters {durationMs, tokens, cost, perCounter{input,output,cacheRead,cacheWrite}}
• tokens = Σ(usage.input + usage.output) — Codex goal_token_delta_for_usage; cache reads/writes reported, never charged to maxTokens (maxCost owns cache-heavy spend)
• cost = Σ usage.cost
• Tree aggregation via fold_usage (V6) including nested ctx.workflow children and retries (R4)
• Monotone saturating deltas vs persisted baselines; single-accountant guard against double-charge (R14); baselines survive durable resume (R3); per-scope baselines for child budgets (§5.2b)
• Concurrent top-level runs meter independently (R11); status surfaces token/cost dimensions (R12)
• B2 enforcement flow unchanged except it now has two more dimensions to trip

This branch first merges origin/verifier/cost-ledger (fold_usage) into B2. Base: budgets/duration-enforcement (B2, #2527). Completes Stack B and issue #2212.

Evidence

Produced by an implement→review→repair goal run (5 turns; completion/evidence complete; risk continue; remaining_work: none; approved):

• npm run check — green (includes the coding-agent tsgo erasableSyntaxOnly pass)
• npx vitest --run --project unit -t "budget" — green: input+output-only token charge with all four counters reported; cost summation; delta monotonicity; single-accountant; independent concurrent runs; resume carries baselines
• Size: 496 changed source lines for the B3 delta (< 500; merge commit separate)
• CHANGELOG: packages/workflows/CHANGELOG.md under ## [Unreleased] ### Added

Spec contract: specs/2026-08-17-run-budgets.md §5.1 / §8 B3.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Greptile Summary

This change adds token and cost limits to workflow run budgets, carrying accounting across nested workflows, retries, checkpoints, and durable resumes. It also adds budget warnings, status reporting, and documentation for the new limits.

The workflow changelog needs consolidation: Unreleased additions are split across duplicate ### Added sections, and the related usage-accounting changes retain ambiguous unknown typing.

Confidence Score: 4/5

The implementation adds substantial budget-accounting behavior; the remaining issue is limited to repository-required changelog and type-quality cleanup.

There is one non-security P2 finding, so the score is 4 under the required scoring table.

Files Needing Attention: packages/workflows/CHANGELOG.md, plus the usage-accounting type declarations in dbos-envelope.ts and budget-meter.ts.

Prompt To Fix All With AI

### Issue 1
packages/workflows/CHANGELOG.md:9
**Duplicate changelog and ambiguous types**

This creates a second `### Added` subsection instead of appending to the existing Unreleased subsection; the same change also introduces ambiguous `unknown` typing in `dbos-envelope.ts` and `budget-meter.ts`, splitting release notes and weakening compile-time shape checking for usage accounting.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "merge origin/main" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Context used - AGENTS.md (source)

[greptile-apps]

Duplicate changelog and ambiguous types

This creates a second ### Added subsection instead of appending to the existing Unreleased subsection; the same change also introduces ambiguous unknown typing in dbos-envelope.ts and budget-meter.ts, splitting release notes and weakening compile-time shape checking for usage accounting.

Context Used: AGENTS.md (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/workflows/CHANGELOG.md
Line: 9

Comment:
**Duplicate changelog and ambiguous types**

This creates a second `### Added` subsection instead of appending to the existing Unreleased subsection; the same change also introduces ambiguous `unknown` typing in `dbos-envelope.ts` and `budget-meter.ts`, splitting release notes and weakening compile-time shape checking for usage accounting.

**Context Used:** AGENTS.md ([source](https://github.com/bastani-inc/atomic/blob/main/AGENTS.md))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.