feat(admin): the budget split tools, the write guard and the allocation view

[edgehero]

Refs #504 (part C, the last of three). Closes #504 together with #573 and #574.

The operator surfaces for the budget split: a model can now set priorities without a keypress, only an operator can change the envelope, and the files that set money and triggers are guarded against pi's own write tools.

Tools

• dispatch_allocations (read): the envelope numbers, the current split and spend per project and repo, the plan's id, writer and validity, and the last 20 outcomes. No plan reason text is ever returned to a model.
• dispatch_priorities_set: sequential, no confirm, works headless. It takes weights (and optional repo weights and a plan life), fills in the basis from the current plan, and applies through the worker's own rules as writer operator-session. It returns the outcome, the refusal reason, the plan id, whether it was clamped and the split before and after. When a plan leaves _other out, its current weight is kept.
• dispatch_envelope_set: behind the operator's confirm, refused headless. It sets the new digest as the expected one, then writes the file atomically through the same parser the worker uses, so the fleet re-bases instead of reporting a hand edit. If the file write fails, the expected digest is put back by a compare-and-set, only while it still holds this write's digest, so two concurrent writes cannot leave the fleet mismatched.
• The existing limit, project and settings writers now refuse a change that would make the live envelope invalid (a floor above a new operator row, a floor for a project being removed, a missing per-job cap), naming the conflict.

The write guard

pi's built-in write and edit tools, and powershell by the guarded file names its command contains as whole path segments (folded the same way), are blocked when the target is the envelope, projects.json, scoped-limits.json, triggers.json, settings.json, the deployment's .env or the deployment pointer. A path that was guarded once stays guarded for the rest of the session, so re-pointing a key cannot unguard a file. The working directory's triggers.json, scoped-limits.json and projects.json are guarded when their key is set (by the environment, the pointer, or the pointer folder's .env), or, with no pointer, when the folder pi started in is a deployment made by init. With no pointer, every guarded file that folder's .env names, and that .env itself, are guarded too; that .env can only add to the guard, never change what the panel reads. An ordinary repository that happens to hold a triggers.json is not affected. A deployment the panel cannot see at all (no pointer, no key set, not the folder pi started in) is not guarded, and SECURITY.md says so. Targets are judged by file identity (a symlink, a hard link, a case variant or a ~ or @ spelling is the file it names), a file that does not exist yet by its parent and its fully case-folded name (so a spelling the file system folds, such as a long s or a capital sharp s, is caught), and a resolution error blocks. Nested tool calls and codemode scripts go through the same guard. bash, names built at run time and the operator's own ! commands stay named residuals in SECURITY.md.

Commands and panel

• /dispatch priorities shows the plan, the split and the history; /dispatch priorities set shop=3 platform=1 writes one. Both are zero spend.
• The ALLOCATION view opens on b: the envelope, each project's share and spend, the current plan with its reasons (escaped like every other agent-written text), and the history. r on one of the newest 20 history rows asks y or n in the frame and reverts to it as operator-revert, skipping the interval and the step. A banner says when the envelope was changed outside the panel, until a later re-base or plan supersedes that edit. Hand-fired cron runs count as runs of their trigger, with their cost attributed to it.

Specs

AMENDED: REQ-ADMIN-VIA-PI-EXTENSION and DES-ADMIN-VIA-PI-EXTENSION (the three tools by name in the Statement and Decision lists, the guard, the residuals), REQ-DELEGATED-ALLOCATION, DES-DELEGATED-ALLOCATION-INSIDE-ENVELOPE, INT-ENVELOPE-FILE-CONTRACT, INT-PRIORITIES-PLAN-CONTRACT, INT-DEPLOYMENT-POINTER-CONTRACT, SECURITY.md.

Release note: the admin imports the worker's new ./allocation export, so the worker is published before the admin. With #573 this completes the doctrine change #504 asked for.

Tests

The headless apply without a dialog, the envelope refusal headless and on decline, the cross-checks, the guard on every file and spelling including nested and codemode writes in a real pi session, reasons escaped in the panel, the b view, the revert, the banner, and the allocation writes against a live Valkey. Each rule was checked by reverting it and watching its test fail (mutation logs kept with the change's working notes).