Enforce cumulative execution allowances for planner reports

[bradhilton]

Builds on merged #945. Planner reports can now use an execution-assigned cumulative allowance. Charges persist before payload writes and never replenish after deletion, restart or ambiguous failure. Duplicate reports spend no additional quota; ordinary failed attempts increment bounded omission counters.

An explicit capture=False scope prevents report creation before replay/source work or filesystem I/O, including initialization before rank binding. Nested scopes cannot re-enable it. Duplicate delivery revalidates the original bytes and completes file and directory fsync before returning, including after an earlier flush failure.

The Caladan caller owns enrollment, aggregate reservation, reporting-thread context and authenticated custody acknowledgments. Its integrated PR is OpenPipe/caladan#588. Standalone behavior remains the default; this PR does not adopt an ART revision in Caladan.

Validation at a2e4b7a: all 30 affected retention controls and Ruff/format/type checks pass. Four causal retry failures were reproduced on the previous head. Fresh Astra/Fable reviews and same-session correction follow-ups are CLEAR. A broader local leaf run passed 60 tests but hit four explicit Torch-import exclusions; full-package validation is left to normal CI. Exact-head Prek 35900833278 and GPU 35900833317 passed. The original CI log confirms trainer-rank-gpu-35900833317-1 terminated at 12:31 PM Mountain on September 23. Prior results remain separately retained.

Limits: quotas cover retained payloads, with caller-reserved metadata; omission counts are failed attempts, not unique lost reports. Corrupt ledgers/process death can prevent counting. ContextVar propagation covers asyncio.to_thread, not arbitrary new threads. No new live W&B delivery or end-to-end GPU retention claim.

Integration with current main

Commit 7580ff59d includes main through a655c051 (#898 and #888). The #898 conflict combined its dataclasses.asdict import with retention's contextlib.nullcontext. All non-PR main files exactly match main, and the three non-reporter retention files are unchanged. The reporter preserves both grouped replay diagnostics and cumulative retention.

The preceding integration head 8448b791b passed fresh Astra/Fable reviews, 841 Megatron tests, 1,854 unit tests, and two-H200 CI. Its CI cluster terminated at 6:47 PM Mountain on September 23. The newer composition has two clean follow-up reviews, 1,157 Megatron tests and 1,875 unit tests passing, and green CPU/GPU CI: quality, GPU. The final CI GPU cluster terminated at 7:13 PM Mountain on September 23. No deployment or frozen experiment change.