feat: enforce explicit context budget recovery

[PerishCode]

What changed

• require an explicit positive input budget for the selected provider and expose it through doctor
• reject known-over-budget strand deliveries before inbox/spine append, with one active block and bounded rejection audit records
• add provider-visible compact capsules with declared source, covered range, estimates, compression ratio, risk, and original-range queryability
• support capsule dry-run and clear an active context block only after the written projection is re-estimated under budget
• restore the repository's module ownership boundaries and move source tests into integration suites

Why

The old im:operator strand exceeded its provider context window. The runtime previously sent the oversized request to the provider and had no explicit recovery projection, while follow-on ingress could keep extending the backlog. This change makes the failure visible and fail-closed, and requires an explicit operator-authored compact before recovery.

Impact

• selected provider profiles must set input_budget_bytes > 0
• over-budget sends return a locked rejection and do not enter canonical history
• operators can audit budget/rejections and preview a capsule before writing it
• existing compacts use the same visible projection envelope with honest undeclared metadata defaults

Validation

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace
• flavor check
• disposable v22→v23, admission block, HTTP rejection, capsule dry-run/write, and block-clear rehearsals