fix: enforce max_minutes on late provider responses

[r0jin]

What

Re-check the transport-clock time budget after each provider response and before processing its tool calls.

This prevents late declare_success and declare_failure responses from bypassing budgets.max_minutes, while preserving the existing max_steps and max_llm_calls counting semantics.

The issue was reproducible with a 6-second max_minutes deadline where a provider returned after advancing the mock transport clock to 7 seconds. Before this change, the late declare_success was still accepted.

Kind of change

• New or changed verb (quackd/verbs/) — I updated docs/architecture.md and quackd list-verbs shows it
• New or changed .duck file (ducks/) — quackd validate passes and I ran it with --provider fake --transport sim2d
• Transport / upstream API — every upstream method name is in quackd/transport/upstream_api.py marked VERIFIED (with a link) or UNVERIFIED, and docs/transport-status.md is updated
• Docs only
• Other

Testing

Added deterministic regression coverage for:

• late declare_success after max_minutes expiry → budget
• late declare_failure after max_minutes expiry → budget
• in-budget provider response → processed normally

The in-budget test also uses max_llm_calls=1 to ensure the fix does not incorrectly reject the final permitted provider response.

Checklist

• uv run ruff check . && uv run ruff format --check . && uv run mypy && uv run pytest pass locally
• No network calls in tests; no API keys needed
• No Pollen Robotics assets (logos, meshes, videos) added
• CHANGELOG.md updated under Unreleased