…ve credit cap; land before the cap

The tier budget table assumes the workflow's $10 ceiling, but the
per-run credit cap is enforced runner-side and was invisible to the
agent, so a tighter consumer cap produced soft targets the hard cap
could not pay for: the 400-credit budget-shed behavior test planned
against the high tier's $10 targets, spent 390 credits on the finder
phase, and was killed by the api-proxy mid-persist with findings in
hand and nothing posted.

Three changes close the gap:

- The frontmatter sets max-ai-credits: 1000 explicitly and mirrors it
  into the agent environment as REVIEW_MAX_AI_CREDITS (consumers that
  override the cap keep the two in sync).
- The router resolves the effective cap (mirror, GH_AW_MAX_AI_CREDITS,
  a visible awf config, then the 1000-credit gh-aw default) and clamps
  the selected tier budget proportionally, floored at the trivial
  tier's values; routing.json carries capClamped and
  effectiveCreditCap so the orchestrator and post-hoc audits see the
  clamp.
- The budget prompt adds an estimated-credits proxy (in-band
  subagent_tokens sum / 5000) and two mandatory checkpoints, the
  critical one after the last finder returns and before claim
  validation, the exact boundary the observed run died at.

router.ts crossed the 1000-line lint budget with the clamp addition; the
cap discovery (resolveCreditCap), the clamp (clampBudgetToCreditCap), and
the gh-aw default constant move to their own module by concern. The router
imports both and stays the single CLI entry point; tests for the moved
functions import from the new module. Prettier fix in router.test.ts rides
along.

…edit cap

The acceptance re-run showed the clamp engaging and the run still dying
at the hard cap (416/400 credits, mid-skill-audit): the clamped soft
target equaled the cap, spend is unobservable mid-run, and requests in
flight at the last checkpoint bill after it. The clamp now sets the
soft dollar target to 75% of the effective cap (LANDING_RESERVE_RATIO)
and scales the other targets to match, so shedding against the targets
lands the run inside the ceiling. The clamp also engages whenever the
tier's own target sits above the reserve-adjusted cap, not only above
the raw cap. review.md tells the orchestrator maxUsd is a landing
target, never money it may finish spending. Acceptance: re-run the
budget-shed test on the kept-alive webapp scaffold at cap 400.

…t-cap

Phase 1 of the live A/B eval plan (#232): the eval corpus learns to carry real change content so a future live producer can run the actual model sub-agents against it.

## Format

A case may now carry an opt-in `live` block (`corpus/live.ts`, re-exported through the loader):

- `prContext`: PR title/description/author/base branch, mirroring production `pr-context.json`. The description is untrusted author text, so adversarial cases can carry their payload there or in the diff.
- An on-disk post-change file tree, via a new `<id>/case.json` + `<id>/tree/` layout coexisting with flat `<id>.json`. A directory containing `case.json` is one case; its tree is never parsed as corpus JSON.
- `mustCatchSpecs` / `mustNotFlagSpecs`: labeled defects as (path, line window, mechanism keyword alternates). Live runs choose their own finding ids, so ground truth matches on anchor window plus mechanism rather than id; the Phase 3 matcher consumes these.

Enforced invariants: the `live` tag and the block imply each other; a live case needs a cleanly-parseable diff (fail-open is fine in production, an authoring error here); spec paths must appear in `changedFiles` and the diff; every non-removed changed file must exist in the tree. `loadLiveCorpus()` returns the subset.

## Cases

Ten cases converted with hand-authored real diffs and trees: the five smoke incidents (money rounding, auth bypass, cache key, race condition, missing index), both clean cases, the adversarial injection case (payload is a code comment in the diff instructing the reviewer to approve), the golden authz holdout, and the money-payments synthetic mutation. Recorded line anchors are rewritten to the authored defect lines; natural files beat content padded to synthetic line numbers, and every anchor is asserted to be an added line so the provenance gate (now active on these cases) keeps them.

The trial-content port landed as #235, stacked on this PR. One acceptance-driven change also landed here: the phase 4 runs missed `incident-sql-missing-index` in all four arms because live cases carried no `routerConfig` lens rules, so specialist lenses never spawned; every live case whose ground truth belongs to a specialist lens now routes that lens on the finding's file (see the "route the specialist lens on each live case" commit).

## Test plan:

- `pnpm run test --run`: 659 tests green, including 17 new loader tests (memfs) covering the live block, both layouts, tree validation, and the tree-JSON exclusion.
- The deterministic suite runs the ten converted cases unchanged (same verdicts, comment counts, must-catch sets), now with the provenance gate active on them.
- `pnpm run typecheck` and eslint clean on the three touched TS files.


## Next steps (human)

1. Review the ten authored diffs and trees for realism; they are synthetic content a live model will read, so plausibility matters more than in ordinary fixtures. Spot-check that each case's recorded finding still describes the authored defect (anchors were rewritten to the authored lines).
2. This is the root of the stack: review and undraft first; #234 and #235 rebase onto it.
3. No live validation needed here; the deterministic suite (`pnpm run test --run`) fully gates it.

Author: jwbron

Reviewers: jeresig, github-actions[bot], jwbron

Required Reviewers:

Approved By: jeresig, github-actions[bot]

Checks: ✅ 9 checks were successful

Pull Request URL: #233