Settle observed child usage before fallible completion checkpoint writes #692

On main 43d5bec351032848af141e1a4fde06c88a3a32ce, dispatch_and_capture_child_attempt writes the completion checkpoint before calling settle_bound_runtime (src/supervise/assignment_execution.rs:3053,3067). If the checkpoint append fails after a child returns reliable usage, the reservation destructor reconciles missing usage using the admission reservation instead of the returned observation. When actual usage exceeds that estimate, the budget ledger can undercount it.

Acceptance still fails closed, but failure of artifact bookkeeping must not discard already observed token consumption. This was found during nested-parent qualification; the shared capture ordering also exists on main. The correction is being developed in #686. Existing pricing, timeout, containment and model-economics issues do not cover this ordering defect.

Acceptance criteria:

• Settle each returned observation exactly once before propagating completion-checkpoint, bookkeeping or import errors.
• Inject a completion-checkpoint append failure with a healthy ledger and observed tokens above the admission reservation; assert exact consumption and zero remaining reservations.
• Retain private raw evidence, preserve the original failure, and prohibit subsequent dispatch, candidate materialization and publication.
• Preserve not-started accounting and unknown-containment refusal; pass relevant regression, formatting, lint and independent source review gates.

This issue does not establish real-provider nested execution or production model economics.