Integrate measured campaign cost ceilings with provider attribution

[chaoz23]

Product outcome

Let local, hosted, and agent orchestrators bound real campaign cost without treating a caller guess or permanent zero as measured engineering evidence.

Current boundary

The internal campaign ledger validates maxCostMicrounits, but MCP execution has no trusted cost provider and therefore does not advertise a cost override. State, elapsed time, memory, disk, and deadline ceilings are live; cost remains intentionally unavailable.

Research and contract

• Define a versioned cost-provider interface for local compute, hosted jobs, and external agent/orchestrator charges.
• Separate estimated reservation, measured charge, and provider uncertainty.
• Bind provider identity/version and units to the campaign policy and each window provenance record.
• Refuse cost-enforced mode when no compatible provider is configured.
• Decide how an upcoming window reserves budget and how under/over-runs reconcile without crossing a hard campaign ceiling.
• Keep story content and credentials out of provider metadata.

Acceptance criteria

• Every nonzero cost value names its provider, version, unit, measurement basis, and uncertainty.
• A hard cost ceiling rejects or contracts work before the next window can exceed the reserved budget.
• Actual charges reconcile atomically while retaining useful partial reports on provider failure.
• Retry/restart cannot double-charge one allocation in the ledger.
• Unsupported environments report cost_accounting_unavailable, never zero cost.
• Tests cover estimation error, provider timeout, duplicate completion, restart, and multi-worker aggregation.

Parent: #93. Follow-up to #95.