feat(runtime): provide bounded managed Codex and Claude access

Parent: https://github.com/langgenius/mosoo/issues/582

Status: owner-approved delivery slice. Human cost/legacy/release decisions remain explicit gates where listed.

## Blocked by

Technical delivery reuses #634 and the owner-authorized staging providers. Launch allowances and default provider funding remain a pre-release decision; the owner explicitly deferred those values while continuing technical implementation and acceptance. No production funding or deployment is authorized by the temporary staging policy.

## Acceptance criteria

- [ ] A Project key calls both managed Codex and Claude without an Agent/provider/Environment setup. Actual runtime and model are recorded, frozen and never silently substituted.
- [ ] Platform defaults and caller caps are enforced at model-request admission; exhaustion stops new requests and preserves truthful status, usage, artifacts and restorable state. In-flight overshoot is explicit.
- [ ] Retain the existing full-access default while verifying integrated runtimes honor it within Session and authorized resources. Project and credential isolation and optional existing BYOK survive.
- [ ] Use only approved test funding. Do not implement settlement or assume free/unlimited access.

## Verified starting point — September 18, 2026

Integrated Driver runtimes and full-access execution are reused. [PR #642](https://github.com/langgenius/mosoo/pull/642), source `e060f465ac24a11fe7efe0cf55fde78042f42e2f`, adds optional per-turn budgets to v2 and passes the [exact-source Linux repository gate](https://github.com/langgenius/mosoo/actions/runs/35349819295). Reviewed additive migration 0016 and this source are deployed only to isolated staging; both Worker revisions, four Container images and the live OpenAPI were verified.

Real Claude acceptance passed 21 assertions: a tiny cap permitted the already admitted first response, blocked subsequent inference, returned `failed / budget_exhausted`, and retained the exact tool-written file bytes. Default selection, platform-maximum rejection and cap-aware idempotency also passed. Costs remain estimates with possible in-flight overshoot. Staging uses an explicitly temporary default of $0.25 and caller maximum $1; these are not production defaults or launch allowances. Local tests cover missing usage, policy removal, concurrent requests, stale grants and failure artifact collection.

Current credential resolution still requires a Project provider key. Direct managed selectors/platform-owned supply are not implemented. The refreshed Codex cold probe reached inference but the OpenAI test provider returned no remaining credits; OpenAI recovery and real budget acceptance remain pending account recharge or replacement credentials. Existing Claude test funding is usable. No production supply, billing, balances, settlement or customer-data changes were made, and this issue remains open.

Start by reviewing PR #642 and additive migration 0016, then inspect the integrated Driver runtimes and existing full-access execution described in the issue. Run the local budget, policy, concurrency, and failure-artifact tests plus the staging acceptance checks; done means managed Codex and Claude access, enforced caps, truthful state, and preserved isolation are verified without production funding changes.

Written by the indexing model from the issue text.