Slack bot: enforce per-run token and spend budgets

Summary

Apply a tighten-only token or spend budget to every run started by the Slack
bot.

The existing per-user request-rate limit bounds prompt frequency. It does not
bound the cost of one accepted run. Mecatl supports run limits internally, but
the Slack integration does not have a supported SDK option for applying a
per-run limit.

Scope

• Define the supported server and TypeScript SDK path for a caller-supplied,
  tighten-only per-run limit.
• Configure the Slack bot with an operator-controlled default limit.
• Apply the limit to every DM and channel run without weakening stricter
  server policy.
• Report a budget terminal outcome to the requesting Slack user without
  exposing internal diagnostics or credentials.
• Document how the run budget relates to the existing per-user request-rate
  limit.
• Add SDK and Slack integration tests for the configured limit and terminal
  behavior.

Completion criteria

• Every Slack-started run receives the configured limit.
• The bot cannot raise a stricter server-owned limit.
• Budget exhaustion produces a bounded, user-scoped Slack response.

References

• #883 and the budget TODO in
  sdk/typescript/examples/slack-bot/src/bridge.ts.
• The Slack bot integration roadmap parent.

Fully or partially written by an AI agent.

Start with the budget TODO in sdk/typescript/examples/slack-bot/src/bridge.ts and review reference #883 and the Slack bot integration roadmap. Trace the supported server and TypeScript SDK path for caller-supplied tighten-only limits, then add the requested SDK and Slack integration tests. Done means every Slack run receives the configured limit, stricter server policy cannot be weakened, and budget exhaustion produces a bounded user-scoped response.