docs: add BUDGET.md — public operating budget + sponsor-influence firewall

[Terastar-Paperclip]

Summary

Adds BUDGET.md — the public, single source of truth for quantcli's money. This is the transparency anchor for the sustainability function: it exists before any contribution platform goes live, so the operating envelope and the firewall are on the record first.

• Operating envelope — $300/mo, framed as a ceiling (not a goal). Raising it needs board sign-off + a public note in the next snapshot.
• Sponsor-influence firewall (non-negotiable) — no governance, no roadmap priority, no CONTRACT.md carve-outs, no vendor-specific concessions, no exclusive support, no endorsement-implying logos, no private side agreements. Changing this section needs board sign-off and a 14-day public-comment window.
• What the money pays for — category table (domains, CI minutes, agent runtime, platform fees, security, capped stipends, reserve) with an explicit out-of-envelope list.
• Where it comes from — GitHub Sponsors + Open Collective, both public ledgers. Marked not yet live (links go real at launch).
• Monthly snapshots — a 2026-05 pre-launch baseline ($0 in / $0 out) plus the template every future month follows. Every figure must link to a primary source.

Notes for review

• Pre-launch: neither platform is enabled yet, so all figures are a $0 baseline. This PR publishes the page and the rules, not live numbers.
• Framing: described quantcli as "a small open-source project that maintains a shared data contract and a family of MIT-licensed Go CLIs" — consistent with the README, not "standards body" language.
• No invented labels: error-flagging routes through the existing TRIAGE.md SLA via a budget-in-title issue (the canonical scheme has no budget label).
• Self-contained: relative links to CONTRACT.md / TRIAGE.md only; no dead or internal links.
• FUNDING.yml (4 repos) and SPONSORS.md are drafted and intentionally held until the platforms are actually live — a FUNDING.yml pointing at a non-existent Sponsors profile would render a dead "Sponsor" button.

Board-approved in substance before publish. Merge is the publish gate.