feat(budget): per-model budget fallback chains

[kusonooyasumi]

Summary

Adds per-model spend caps with fallback chains: when a model reaches its cumulative budget, agents move to a cheaper configured model instead of the whole scan stopping.

Stacked PR (fork-internal). Base is pr1-model-routing, so this diff shows only the budget-fallback changes on top of PR 1. Once PR 1 (usestrix#824) merges, this will be retargeted to usestrix/strix:main as a standalone upstream PR.

Behavior

• No change by default — no budgets configured means no fallbacks.
• A fallback is checked after a response returns, so a call can slightly overshoot. Strix discards that boundary response before its tool calls run, switches the agent's persisted model, and replays the session on the fallback — avoiding duplicate side effects and keeping resume on the right layer.
• A model budget without a fallback only tracks usage; it does not stop the scan.
• The scan-wide --max-budget-usd remains a hard stop and takes precedence.

Config

{
  "llm": {
    "model": "openai/gpt-5.4",
    "subagent_model": "z-ai/glm-4.7",
    "model_budgets_usd": { "openai/gpt-5.4": 20.0, "z-ai/glm-4.7": 10.0 },
    "model_fallbacks": {
      "openai/gpt-5.4": "z-ai/glm-4.7",
      "z-ai/glm-4.7": "deepseek/deepseek-chat"
    }
  }
}

Validated for cycles, self-references, and fallback sources that lack a budget.

Implementation notes

• strix/core/model_routing.py (new): resolve_budget_model skips already-exhausted layers at agent create/resume; chain_uses_chat_completions_tools keeps the tool schema compatible across every layer.
• The usage hook switches all agents sharing an exhausted model to the next layer at a response boundary.
• Usage ledger + TUI stats attribute tokens/cost to each model actually used, including fallback models.

Test plan

• pytest tests/test_budget_fallbacks.py — chain resolution + case-insensitive lookup, cycle/missing-budget rejection, exhausted-layer skip, cross-chain tool schema, per-model usage grouping, hydration without double-counting, and the response-boundary switch (single + multi-layer + stale in-flight).
• Full suite green (260), ruff + mypy clean.

[kusonooyasumi]

Credential consistency for budget fallbacks

Building on the per-call credential fix in the routing PR, this PR's fallback path was updated so a fallback model re-resolves its credential rather than inheriting the exhausted model's key.

• The shared resolve_route_api_key helper now lives in strix/core/model_routing.py (used by the child factory, the usage hook, and AgentCoordinator.transition_model).
• When a budget fallback switches an agent's model — in both ReportUsageHooks and transition_model (which applies the switch to every matching agent) — model_settings is rebuilt with the fallback's per-call api_key. This matters for cross-provider fallbacks and same-provider-different-key setups, where the global env var can't distinguish the two.

New test test_fallback_carries_subagent_credential_per_call asserts a cross-provider fallback lands the correct key in extra_args.