fix(agent): sticky cost_status priority ladder (#67764)

[DavidMetcalfe]

Fixes #67764.

Problem

cost_status is supposed to communicate the accuracy confidence of an
accumulated dollar value across a session's per-call rows. Today it's
overwritten by every new API call (latest-call-wins), so a session with
100 actual-confidence calls followed by 1 estimated call downgrades the
whole accumulated row to "estimated" — even though the user-visible
fact "the cost is whatever OpenRouter said" hasn't changed.

Three layers exhibit the bug: SQL UPDATE on sessions (lines 2887, 2908),
SQL UPSERT on session_model_usage (line 3087), and the in-memory
agent.session_cost_status writes at agent/conversation_loop.py:2321,
agent/codex_runtime.py:150. The /insights aggregator (agent/insights.py:583)
had the same shape in Python. tools/delegate_tool.py:2862 had a bespoke
"sticky-ish" guard which is unified onto the same helper.

Fix

Sticky-max rule across all layers: actual (3) > included (2) > estimated
(1) > unknown (0). Once any call has reported actual, the accumulated
row stays actual forever.

• New helper agent/usage_pricing.py::sticky_cost_status(current, new)
  returns the higher-rank value (with sentinel -1 for missing/invalid
  current, so any valid new wins; equal ranks return the new value; bad
  values fall through to "estimated").
• SQL COALESCE replaced with a CASE-expression ladder at three sites.
  The interpolated new value is matched against a Literal allow-list
  before embedding (SQL-injection safety). Verified by
  test_sessions_status_with_unknown_literal_input.
• In-memory assignments in agent/conversation_loop.py and
  agent/codex_runtime.py now call sticky_cost_status(...)
  instead of direct =. agent/insights.py:583 does the same for the
  per-model dict loop.
• tools/delegate_tool.py replaces its bespoke guard with the same
  helper for codebase consistency (and so the rule evolves in one place).
• cost_source is deliberately unchanged at all four sites (per the brief's
  Layer 4: no clean priority ladder for cost_source).

Tests

• 30 tests in tests/test_cost_status_priority_ladder.py (new file)
  covering: rank mapping, sticky behavior on each pair of statuses,
  return-type Literal guarantee, SQL UPSERT accumulation, sessions
  aggregate SQL aggregation, SQL injection sanitization, in-memory
  dispatch in conversation_loop / codex_runtime / insights / delegate_tool,
  end-to-end brief reproduction scenarios.
• Existing tests/hermes_state/, tests/run_agent/test_notice_spine.py,
  tests/agent/test_insights.py, tests/tools/test_delegate*.py: no regressions.

Out of scope

• Phase 2 (wire actual_cost_usd from provider responses): still
  a separate deferred issue. Once Phase 2 lands, the priority ladder
  here will gain a real "actual" promotion path.
• cost_source aggregation: not changed (no clean priority ladder).
• Memory / rehydration compatibility: this PR is independent of
  PR fix(agent): rehydrate session cost counters on agent construction (#67762) #67770 (rehydration). Rehydration stays correct; cost_status
  reaches the agent via the same in-memory attribute paths and is
  now also sticky across those writes.

[alt-glitch]

This was generated by AI during triage.

Related to #67764 and open #67770. This is the active reimplementation of closed, unmerged #67774's sticky-status repair; #67770 separately handles restart rehydration. The overlapping SessionDB work needs consolidation rather than duplicate closure.