feat: Grok broker usage accounting, per-wake limits and public projection

[apresmoi]

Summary

• Broker stays the single sealed usage writer. Turn record v2 seals usage, outcome, model, request count, limit reason and the exact ledger lines; replay never re-meters and completes a crash-interrupted append exactly once. A turn published by rename is never re-sealed as failed.
• Control protocol v2 and engine-broker-service.v2: per-slot ledger path, limits {maxRequests, maxTokens, timeoutMs} and declared model/effort from closed lists. Wakes may only lower limits (DAIMON_ENGINE_WAKE_TIMEOUT_MS / _TOKEN_CEILING, Codex names aliased).
• Proxy meter: one upstream request in flight per turn; hard request cap and deadline before upstream; token ceiling counts cached input, overshoot bounded to one request; implausible usage rejected and missing usage charged a conservative estimate (usage_source: "estimated"); tripped limits abort the in-flight upstream call and kill the worker.
• Ledger rows gain turn, limit_reason, model, estimated_requests; per-request rows with started_at/ended_at for Grok and Codex. Every consumer must dedupe usage rows by turn (wake fuse does).
• Org config accepts Grok model + reasoningEffort together; resolveOrganizationGrokBrokerProjection (noopolis.daimon.grok-broker-projection.v1) and the noopolis.daimon.grok-slot-preflight.v1 receipt schema/verifier for Paideia and the training container.

Stacked on #25. Contract manifest digest changes; Spawnfile re-pins in its follow-up.

Verification

• Full npm test: 752 pass / 0 fail / 9 skipped. Typecheck, verify:contract-manifest, verify:native, verify:production-closure pass.
• Mutation checks for every enforced property (logs kept locally).
• Live zero-cost check with the real launcher and Grok 1.0.34 against a stub model: normal turn metering, request cap refusal before upstream, timeout abort, raised-limit refusal, replay without re-metering.
• Three rounds of cross-vendor (Grok) adversarial review; all blocking findings fixed.

🤖 Generated with Claude Code