Daily AIC guardrail cost scales with 24h run volume — consider a repo-memory-backed rollup instead of per-run artifact download

## Problem

On a repo where the guarded workflow fires frequently (every push + every review comment), `check_daily_aic_workflow_guardrail.cjs`'s per-activation cost scales with how many runs land in the trailing 24h window. Even with the existing `actions/cache` JSONL rollup in place, every cache-miss run still costs a full `listArtifacts` + `downloadArtifact` round-trip.

Measured on a repository like this: a real `activation` job spent **46.86s** in the "Check daily workflow token guardrail" step alone, out of ~93s total job time — dwarfing every other step in the job (the next largest cost, the Actions runtime's own action-repository download in "Set up job", was 20.6s, and that one isn't controllable via workflow config at all since it's runtime-level).

## Root cause (as best I can tell from `actions/setup/js/check_daily_aic_workflow_guardrail.cjs`)

- `listCompletedWorkflowRunsPage` paginates up to `MAX_WORKFLOW_RUN_PAGES` (10) pages of 100 runs each across the 24h window.
- `computeMaxInspectableRuns` budgets a rate-limit reserve, but every candidate run not already in the JSONL cache (`daily_aic_cache_helpers.cjs`) still needs `getRunAIC` → `listArtifacts` + `downloadArtifact` (2 API operations) to resolve its AIC.
- The `actions/cache`-backed JSONL rollup helps (a hit skips the artifact round-trip entirely), but on an active-enough workflow the number of *new* runs since the last cache write can still be large enough to dominate the guardrail step's wall-clock time.

## Proposal

Let the guardrail read/write its rolling total through a small, append-only, timestamp-bucketed file — conceptually the same shape as the `repo-memory:` feature gh-aw already ships (some workflows already use this for per-PR review ledgers) — instead of relying solely on `actions/cache` + per-run artifact downloads. A cache hit would become a file read against an already-checked-out/committed rollup instead of a paginated Actions-API scan plus an artifact download for every miss.

This could be opt-in rather than a default-behavior change, e.g. something like:

```yaml
max-daily-ai-credits:
threshold: 10000
backend: repo-memory

...since not every workflow using the guardrail also has repo-memory configured.

Prior art / related code

- repo-memory: (existing feature)
- actions/setup/js/daily_aic_cache_helpers.cjs
- actions/setup/js/check_daily_aic_workflow_guardrail.cjs

Secondary, unrelated observation

While measuring the above, I noticed the same job's "Set up job" phase spent ~14s of its 20.6s total downloading the github/gh-aw-actions action repository itself —ersus well under 2s each for every other referenced action (actions/checkout, actions/cache, actions/github-script, etc.). This tracks with it being a larbundle repo (the very next step, "Setup Scriptsf it) rather than a small single-purpose action. Not asking for anything here, just flagging it in case a slimmer release-tarball distribution is easy to pick up alongside the above.

Environment

- gh-aw CLI version: v0.88.7 (also reproduced c

Start by reading actions/setup/js/check_daily_aic_workflow_guardrail.cjs and daily_aic_cache_helpers.cjs, then inspect the existing repo-memory feature and how the max-daily-ai-credits workflow configuration is handled. Define the opt-in backend boundary and verify that the rolling total preserves the guardrail behavior while avoiding per-run artifact downloads; the payload names no tests to run.

Written by the indexing model from the issue text.