Trace worker requests and reserve time for verification

[inquerium]

What this changes

A worker can produce a valid patch and still exhaust its budget before verification. This adds opt-in token/time reserves for isolated scoped/focused OpenCode jobs: stop the initial model turn at the soft threshold, wait for the prompt response, require abort acknowledgement and idle status, then run caller acceptance checks. Failed checks use the existing bounded same-agent repair. Errors, caller cancellation, hard budgets, ownership and integration checks retain authority.

Durable workers also save bounded metadata-only request/tool traces, available through jobs_read(artifact: "trace"). Traces distinguish missing usage from reported usage, correlate tools with assistant messages, record output sizes/timing, and identify repeated read arguments with private per-execution fingerprints. Benchmark runs preserve these artifacts. No prompt, source, tool arguments, tool output or raw error content is added to the trace.

This PR is stacked on #5; its diff contains only the follow-up implementation. Reserves default to zero. The capability fingerprint prevents reuse of an older daemon that would silently ignore them.

How it was tested

• All 16 local deterministic regression suites pass, including checkpoint cancellation, hard-budget overshoot, failed stop confirmation, provider errors, bounded repair, privacy, missing usage, and trace retrieval through the real MCP daemon.
• The real installed OpenCode 1.18.31 engine passed node scripts/probe-engine-checkpoint.js against local synthetic inference: wrote a file, stalled on request two, stopped, confirmed idle, then passed verification in about five seconds. Evidence is in benchmarks/results/2026-09-21/checkpoint-smoke.json.
• Syntax and whitespace checks pass on macOS arm64. No new runtime dependency.

Limits and review order

Review/land #5 first, then retarget this PR to main. Nothing has been merged or released. GitHub Actions on #5 could not start because GitHub reports a repository-account billing lock; local results are not presented as green CI.

This is a draft pending broader workload evaluation. The synthetic probe establishes lifecycle correctness, not a coding-quality or token-saving claim. Assistant-message durations can include tools; provider retries/background sessions and native request timing are not fully observed. Worktree isolation is not a process sandbox, and arbitrary detached processes remain outside the stop guarantee. Strong acceptance tests are necessary. See docs/worker-service.md for configuration and coverage.