fix(workflows): enforce immutable model routes

[andrei-hasna]

Implements OPE2-00252 (Todos 0f00363b-fdfc-4870-ab74-bfabd819e3dc).

• persists requested and effective route receipts through workflow admission, recovery, descendants, workers, and verifiers
• revalidates exact gateway, provider, model, reasoning, tier, profile, worktree, context, and fallback constraints before external effects and provider attempts
• rejects finite budget_usd before launch because the current production provider path has no provider-backed credit reservation/accounting controller
• adds two-sided zero-provider-effect, restart/descendant, receipt, and accounting tests

Remote Rust, Bazel, generated-artifact, and exact-head checks are running. This PR remains draft and has no review request.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}