codex/budget accounting

[merlerm]

Summary

Meter Codex from native per-response token_usage_record usage, deduplicated per
experiment across root/subagent sessions and continuations. Resettable UI totals
and turn-scoped stdout usage are not authoritative for a finite budget.

• Preserve cumulative accounting; fail closed on missing/invalid/mutated history,
  unexpected models, status-write failures, or no timely initial usage.
• Stop the target invocation's process tree at budget, including detached children,
  without signaling parallel experiment siblings. Evaluate the last saved policy.
• Resume unconfirmed exits with only the remainder; do not resume with <= $0.50.
• Publish atomic experiment-local budget status and advisory $2/$1 warnings.
  Warnings prioritize targeted finishing work, not immediate final answers.
• Keep confidence honest; unchanged code may reflect useful validation. No
  unchanged-file heuristic or artificial low-confidence retry cap.

Validation

• First PR layer: 115 focused tests passed, including synthetic strict-Apptainer
  cutoff and real process-tree/parallel isolation. No paid calls in CI tests.
• Full $20 strict Kinematic2D run: independently verified $19.522296, four useful
  continuations, stopped with $0.477704 left, complete 100-episode evaluation.
• A prior $5 smoke exposed contradictory wrap-up instructions; corrected smoke
  spent $4.7431024 with two productive continuations rather than empty restarts.
• Source typing and import-order checks. Repository .pylintrc has legacy options
  rejected by the installed Pylint; focused code lint passed with only those
  configuration diagnostics disabled. GitHub CI remains the authoritative check.

Limits / follow-up

Costs are configured API-equivalent estimates including caching, not subscription
billing. In-flight usage can overshoot before the next completed response record.
The paid validation runs exercised remainder stopping, not the live hard-kill path;
that path has deterministic native-record/container coverage.

Status-file warnings are advisory, not guaranteed live steering. App Server steering
is deferred. Session/status files are not a security boundary against a deliberately
malicious agent. Existing retry telemetry retains some final-attempt fields and
separate prior-attempt totals; use native logs for full-run timing/token analysis.

The next stacked PR adds end-to-end fake-CLI coverage and an opt-in standalone
integration_tests/check_codex_budget.py live diagnostic. No environment changes,
model/pricing changes, credentials, private seeds, or experiment artifacts included.