Roadmap: enforceable per-loop token budgets

[lodar]

--ceiling sets a per-loop token budget and escalates with proof at the limit. Make the token ceiling hard-enforceable (halt or park the loop at the limit) the way the cost budget already is.

[lodar]

Shipped in v0.10. The per-loop token ceiling is now hard-enforced rather than advisory. When a loop's spend crosses --ceiling, the heartbeat marks the run escalated and PARKS the loop's live child tasks so the token spend actually stops (this was the gap: a fire-and-forget loop spawn has no driver, so the ceiling was advisory for exactly the common case). It then raises an escalate-with-proof approval on the originating task to continue with a higher ceiling or stop. Loops also carry a low built-in default ceiling so none runs unbounded. This mirrors the cost-budget hard stop the issue asked for.