Wire EnforceResourceCeiling into runtime and sandbox enforcement

[serrrfirat]

Closes #3144

Summary

Wires Obligation::EnforceResourceCeiling into the Reborn host-runtime obligation path so non-output resource ceilings are either handed to host-owned enforcement or rejected fail-closed instead of being silently accepted.

Issue context

• Issue: Wire EnforceResourceCeiling into runtime and sandbox enforcement #3144
• Related: feat(reborn): wire built-in obligations and handoffs #3080, [Reborn] Integrate cost-based budgets into ResourceGovernor and HostRuntime #3141, [Reborn] Compose ironclaw_host_runtime services #3087
• Base branch: reborn-integration
• Head branch: nearai/ironclaw:sandcastle/issue-3144-wire-enforce-resource-ceiling

Implementation

• Includes EnforceResourceCeiling in post-dispatch obligation handling.
• Adds host-runtime resource ceiling validation/handoff logic for estimate/usage ceilings.
• Rejects unsupported sandbox quota fields fail-closed rather than accepting unenforced limits.
• Keeps existing EnforceOutputLimit behavior intact.
• Documents the host-runtime resource ceiling handoff behavior.

Changed files

Cargo.lock
crates/ironclaw_capabilities/src/obligations.rs
crates/ironclaw_host_runtime/Cargo.toml
crates/ironclaw_host_runtime/src/obligations.rs
crates/ironclaw_host_runtime/tests/builtin_obligation_handler_contract.rs
docs/reborn/contracts/host-runtime.md

Diff stat

Cargo.lock                                         |   1 +
crates/ironclaw_capabilities/src/obligations.rs    |   1 +
crates/ironclaw_host_runtime/Cargo.toml            |   1 +
crates/ironclaw_host_runtime/src/obligations.rs    | 160 +++++++++++++++-
crates/ironclaw_host_runtime/tests/builtin_obligation_handler_contract.rs | 201 ++++++++++++++++++++-
docs/reborn/contracts/host-runtime.md              |   3 +-
6 files changed, 360 insertions(+), 7 deletions(-)

Acceptance criteria coverage

• EnforceResourceCeiling now has a concrete host-runtime handoff path.
• Non-output ceiling fields are checked against estimates/usage or fail closed.
• Unsupported sandbox quota fields are rejected instead of silently accepted.
• Tests cover allow/deny paths for non-output ceiling fields.
• Existing output-limit behavior is kept separate.

Verification requested by issue

cargo test -p ironclaw_host_runtime
cargo test -p ironclaw_resources
cargo test -p ironclaw_dispatcher
python3.11 scripts/check_no_panics.py --base origin/reborn-integration --head HEAD

Review notes

This PR was generated from the Sandcastle branch for #3144 and should be reviewed against reborn-integration.

[gemini-code-assist]

Code Review

This pull request implements the EnforceResourceCeiling obligation within the BuiltinObligationHandler. The changes introduce logic to validate resource estimates against defined ceilings before capability dispatch and verify actual resource usage (including USD cost, token counts, and wall-clock time) after dispatch. The PR also adds the rust_decimal dependency, updates the host runtime documentation, and includes comprehensive contract tests. Feedback was provided regarding the naming of a helper function to ensure consistency with other validation methods.

[gemini-code-assist]

The function name check_optional_decimal_ceiling is misleading because it actually requires the actual value to be present if a ceiling is specified. Renaming it to check_required_decimal_ceiling would be more consistent with check_required_integer_ceiling and better reflect its behavior.

Suggested change

	fn check_optional_decimal_ceiling(
	fn check_required_decimal_ceiling(