P1 security batch: quota execution checks, cost accounting, goal/coordinator semantics, PR channel, orphan signature, control-plane and console hardening

- Docker quota watchdog + fail-closed quota checks, system tasks need real owner
- max_cost_usd actually accumulated, cancel records cost, estimated rows excluded from unpriced cap, cache_write declared non-billed
- goal-resume keeps original verify on breakpoint resume, goal retry falls back to resume, goal_max_rounds capped at 100 at create and execution
- coordinator children inherit parent model/effort, orphans marked interrupted with audit
- PR jobs on docker workers return explicit needs_local_worker instead of silent empty
- worker code signature covers 6 files and is checked before claim, fail-closed
- sub2api lazy provisioning with rotation, backup whitelist + 0600, push SSRF block, repos/workers desensitized, key/project audits and limits, console buttons/quota/status wording, coordinator/automation quota reserve

cloud/cost.py

@@ -18,6 +18,28 @@ may charge differently. Override per model with
 with no price record ``usd_micros=None`` and reports count their
 tokens in ``unpriced_actual_tokens`` instead of pricing them at zero.
 
+cache_write_input_tokens: EXPLICITLY NOT BILLED HERE (P1 decision,
+not an oversight). host.py collects ``cacheWriteInputTokens`` from
+upstream tokenUsage events and sandbox.py carries it in usage dicts
+for observability, but it is NOT added to ``total_tokens`` (upstream
+total is input + output), NOT stored in ``cost_records`` (``record``
+takes input/output/cached only), NOT priced by ``price_usd_micros``,
+and NOT counted toward the unpriced-token cap (worker counts input +
+output from ``source="actual"`` rows only). Rationale: no price-table
+entry and no relay bill evidence treats cache creation as a
+separately billed token stream for the OpenAI-style relay models in
+use; cache_write here is prompt-cache bookkeeping detail, not a
+second charge on top of input. If a future provider bills cache
+creation separately, the price table must gain an explicit
+cache_write rate FIRST -- only then may ``record``/pricing count it.
+Until then, counting it would double-charge input tokens that are
+already priced (or inflate the unpriced cap with non-spend).
+
+Unpriced cap scope (P1): ``unpriced_actual_tokens`` and the worker's
+cap query count ``source="actual"`` rows only. Estimated rows
+(``source="estimated"``, character-count fallback when no usage
+events arrive) are never real spend and must not trip the cap.
+
 Dead end, documented so nobody retries it: the app-server's
 account/usage/read method requires ChatGPT account authentication and
 fails on a relay API key (2026-10-26 probe: ``codex account
@@ -98,6 +120,9 @@ def price_usd_micros(model, input_tokens, cached_input_tokens,
     output rate. Reasoning tokens are already inside output_tokens
     (provider total = input + output), never added twice. Returns None
     when the model has no price entry (caller records usd as unknown).
+    cache_write_input_tokens is deliberately NOT a parameter here:
+    it is not billed separately (see module docstring); callers must
+    not add it to input_tokens to “count it anyway”.
     """
     rates = model_prices().get(model)
     if rates is None: