Enforce hard per-turn tool budgets and write-first constraints across model routes

[Hmbown]

Evidence

Canceled task task_96f543f76c374fb2 was routed to GLM-5.2/ZAI (not GPT-5.6). Its prompt explicitly required:

• no exploration,
• no subagents,
• modify six named files,
• a hard budget of at most eight tool calls.

The runtime admitted 13 read_file calls in ~20 seconds, including continuation reads and extra files outside the named six, then produced no write or verification call before cancellation. Parallel tool batching treated the stated cap as advisory instead of an enforced admission limit.

This is adjacent to #4414 (no-progress turn loops), but distinct: a turn can make rapid, low-value progress while violating its contract and exhausting its tool budget.

Acceptance criteria

• Treat per-turn tool-call budgets as a hard scheduler-side admission limit, including every call in a parallel batch.
• Reject or truncate a proposed batch that would exceed the remaining budget, with a visible reason and remaining-call count.
• Honor no exploration / named-file-only / write-first constraints in the tool policy rather than relying solely on model compliance.
• Provide a compact “constraint receipt” in the task UI: allowed paths, allowed tool families, calls used/remaining, and first-write deadline when requested.
• Detect repeated exploratory reads of already-truncated files and route them through the Detect and break non-progressing turn loops with an explicit recovery path #4414 no-progress recovery path.
• Record model/provider/route telemetry so regressions can be compared across Codex/GPT, GLM, and other routes without falsely attributing a provider-agnostic scheduler failure to one model.
• Add deterministic tests for an 8-call cap, a 4-tool parallel batch with 2 calls remaining, and a write-first named-file task.

[Hmbown]

Clarification from the reported task: the within 8 tool calls limit came from the task prompt, not an implicit CodeWhale default. The product contract should therefore make constraints optional and attributable: show whether each limit came from the user, parent task, workspace policy, or a model profile; do not invent arbitrary default caps; and enforce an explicitly chosen cap deterministically rather than treating it as a suggestion.