feat(05-02): replace flat budget check with policy-based gate, wire incident checks into run completion and heartbeat

- Replace flat budgetMonthlyUsd check with evaluateBudgetGate in getRunEligibilityFailure
- Add projectId parameter to getRunEligibilityFailure for project-scope policy evaluation
- Update all 3 call sites to pass projectId where task context is available
- Wire checkAndCreateIncidents into worker-service run-finished handler for post-run incident creation
- Wire autoCloseExpiredIncidents into heartbeat for window rollover cleanup (D-06)
- Pass budgetService dependency to orchestration-service and worker-service via service-graph
- Mark autoPauseBudgetExceededAgent as deprecated (superseded by BudgetEnforcementService)

src/main/service-graph.ts

@@ -191,6 +191,7 @@ export function createServiceGraph({
       dispatchRunToWorker,
       processRunCompletion: (run, event) => processRunCompletion(run, event),
       notify,
+      budgetService: getOrCreateBudgetEnforcementService(),
     });
 
     orchestrationService = createOrchestrationService({
@@ -219,6 +220,7 @@ export function createServiceGraph({
           }
         };
       })(),
+      budgetService: getOrCreateBudgetEnforcementService(),
     });
     workerService.createWorker();