feat: enforce experiment provider attempt budgets

[christopherjnelson]

Summary

• add a server-owned per-experiment provider-attempt ceiling configured through World Setup
• reserve full-tick capacity before dispatch and account for retries only when provider calls actually start
• retain known and unknown attempt cost across cancellation even when world state rolls back
• expose authoritative attempt usage and budget exhaustion through the API and World Lab
• document the boundary and defer a true monetary ceiling plus export/SQLite attempt ledger to O2b

Testing

Owner confirmed the complete local validation suite is green:

• pnpm validate
• pnpm test:e2e