refactor(cost): single writer for cost_entries, finishRun reads SUM

Cost was written through three independent paths: worker-runner shipped
`finalUsage.costUsd` in run-finished -> finishRun wrote `runs.cost_usd`,
`tasks.cost_usd += costUsd`, `agents.spent_monthly_usd += costUsd`, and
inserted a per-run aggregate row in cost_entries. CostWriter
additionally inserted per-message rows in cost_entries from main. Any
CostWriter failure created silent drift between `SUM(cost_entries)`
(read by budget enforcement) and `runs.cost_usd` (read by the UI).

Make CostWriter the single writer, finishRun the single reader.

- Add `db.recordCostEntry(...)` as the first-class insert path for
  per-message cost rows. CostWriter calls it; tests call it directly.
- Remove the aggregate INSERT from finishRun. finishRun now reads
  `SELECT COALESCE(SUM(amount_usd), 0) FROM cost_entries WHERE run_id=?
  AND unattributed=0` and writes that as the authoritative run total to
  runs.cost_usd, tasks.cost_usd, and agents.spent_monthly_usd.
- Drop `costUsd` from `finishRun` input, the worker `run-finished`
  ChildMessage shape, the automation `RunFinishedEvent` type, and every
  caller + test fixture. Cost is owned by the per-message path.
- worker-runner stops extracting `usage.cost.total` — token counts stay
  for session accumulation, cost comes from pi-ai via CostWriter.
- run-finished-helpers now gates budget incident checks on
  `event.status === "succeeded"` instead of a cost field that no longer
  exists on the event.
- automation-run-completion fires `budget_threshold` on every succeeded
  run (post-run spent_monthly_usd already reflects the SUM path).
- Update budget tests to write a `recordCostEntry` before `finishRun`
  to simulate the per-message cost path; drop `costUsd` from cross-
  subsystem, edge-case-budget, database, and related fixtures.

One writer, one reader, one source of truth. No drift.

tests/integration/agent-model-switching.spec.ts

@@ -135,7 +135,6 @@ describe("agent model switching", () => {
       signal: null,
       model: "gpt-5.4",
       sessionDisplayId: null,
-      costUsd: null,
       unattributedCost: true,
     });
 

tests/integration/autonomous-chain/crash-recovery.spec.ts

@@ -81,7 +81,6 @@ describe("Step 7: Worker crash recovery (database layer)", () => {
       signal: null,
       model: null,
       sessionDisplayId: null,
-      costUsd: null,
       unattributedCost: true,
     });
 

tests/integration/autonomous-chain/run-failure.spec.ts

@@ -41,7 +41,6 @@ describe("Step 6: Run failure escalation (database layer)", () => {
       signal: null,
       model: "gpt-5-codex",
       sessionDisplayId: null,
-      costUsd: 0.5,
       unattributedCost: false,
     });
 

tests/integration/cross-subsystem.spec.ts

@@ -210,6 +210,7 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
 
     // 4. Execute run
     db.markRunStatus(runId, "running", "Starting");
+    db.recordCostEntry({ runId, companyId: s.companyId, agentId: s.agentId, taskId, connectorId: "gemini-cli", amountUsd: 0.05, unattributed: false });
     db.finishRun({
       runId,
       status: "succeeded",
@@ -219,7 +220,6 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
       signal: null,
       model: "gemini-2.5-pro",
       sessionDisplayId: null,
-      costUsd: 0.05,
       unattributedCost: false,
     });
 
@@ -339,6 +339,7 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
 
     db.checkoutTask(taskId, runId);
     db.markRunStatus(runId, "running", "Starting");
+    db.recordCostEntry({ runId, companyId: s.companyId, agentId: s.agentId, taskId, connectorId: s.connectorId, amountUsd: 1.5, unattributed: false });
     db.finishRun({
       runId,
       status: "succeeded",
@@ -348,7 +349,6 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
       signal: null,
       model: "gemini-2.5-pro",
       sessionDisplayId: null,
-      costUsd: 1.5, // $1.50 exceeds $1 budget
       unattributedCost: false,
     });
 
@@ -452,6 +452,7 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
     });
     db.checkoutTask(taskId1, runId1);
     db.markRunStatus(runId1, "running", "Starting");
+    db.recordCostEntry({ runId: runId1, companyId: s.companyId, agentId: s.agentId, taskId: taskId1, connectorId: s.connectorId, amountUsd: 3.0, unattributed: false });
     db.finishRun({
       runId: runId1,
       status: "succeeded",
@@ -461,7 +462,6 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
       signal: null,
       model: "gemini-2.5-pro",
       sessionDisplayId: null,
-      costUsd: 3.0,
       unattributedCost: false,
     });
 
@@ -494,6 +494,7 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
     });
     db.checkoutTask(taskId2, runId2);
     db.markRunStatus(runId2, "running", "Starting");
+    db.recordCostEntry({ runId: runId2, companyId: s.companyId, agentId: s.agentId, taskId: taskId2, connectorId: s.connectorId, amountUsd: 3.0, unattributed: false });
     db.finishRun({
       runId: runId2,
       status: "succeeded",
@@ -503,7 +504,6 @@ describe("Cross-Subsystem Pipeline (D-04)", () => {
       signal: null,
       model: "gemini-2.5-pro",
       sessionDisplayId: null,
-      costUsd: 3.0,
       unattributedCost: false,
     });
 

tests/integration/database.spec.ts

@@ -135,7 +135,6 @@ describe("AppDatabase", () => {
       signal: null,
       model: "gpt-5-codex",
       sessionDisplayId: "session-1",
-      costUsd: 12.5,
       unattributedCost: false,
     });
 

tests/integration/document-run-provenance.spec.ts

@@ -149,7 +149,6 @@ describe("document run provenance", () => {
         status: "succeeded",
         summary: "Updated the market report",
         errorMessage: null,
-        costUsd: null,
       }, () => false);
 
       const task = harness.db.getTask(harness.taskId);