feat(ai): reclaim stranded budget reservations safely

[first-assist]

Summary

• add bounded reserved/committed capacity reporting and audited MFA-gated reclamation of expired stranded reservations
• distinguish proof-bearing pre-transport budget denial from uncertain post-transport budget failures
• preserve retained provider sessions for proven pre-transport denial while keeping generic budget denial fail-closed
• advance graphql-orm-ai to 0.84.0, tool profiles to 0.7.0, and AI schema module to 0.63.0

Migration

Apply AI schema module 0.63.0 before workers serve traffic. The migration adds typed predicates and one composite reservation index; it performs no row rewrite or backfill.

Verification

• full combined and seven isolated provider suites
• focused ordinary/supervised/retained/dynamic denial and reclamation tests
• warnings-denied affected-crate Clippy and strict Rustdoc
• PascalCase GraphQL, PostgreSQL/MSSQL compile, disposable PostgreSQL parity
• docs, inventory, dependency boundaries, release policy/state, deterministic manifest, SemVer, formatting and diff validation

Two unchanged baseline full-workspace Clippy findings are outside this diff and documented in the handoff.

Documentation impact

• Documentation updated
• No documentation impact

Explanation: CHANGELOG, migration guidance, README, usage/budget guidance, implementation status, schema-module tests, and generated workspace inventory were updated.