merge: integrate oss branch — budget gating, MCP back-channel, events, loopback-only bind

Key features from OSS branch:
- Budget gating: rolling per-provider spend caps with BUDGET_EXCEEDED task state
- Agent MCP back-channel: runners mint tokens; /mcp endpoint resolves them
- Chatbot MCP server at /chatbot/mcp (requires api_token in config)
- Event timeline: unified event stream replacing ad-hoc question/summary flows
- Loopback-only default bind (127.0.0.1:8484); external_bind_allowed=true to expose
- repository_url required on task creation (enforces traceability)
- Auto-checker: spawns verification task after each execution

Conflict resolutions:
- serve.go: keep cfg.Runners.XEnabled() conditional registration from main + agentRegistry from oss
- config.go: keep RunnersConfig from main + BudgetConfig/ExternalBindAllowed from oss
- server.go: handleStaticFiles (base-path rewrite) kept; deduplicated duplicate from both sides
- executor/claude.go: accepted oss deletion (ClaudeRunner replaced by ContainerRunner)
- container_test.go: added noopChannel + AgentChannel parameter to Run call

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 68 insertions, 0 deletions

diff --git a/internal/api/budget_test.go b/internal/api/budget_test.go
new file mode 100644
index 0000000..d59836d
--- /dev/null
+++ b/internal/api/budget_test.go
@@ -0,0 +1,68 @@
+package api
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/thepeterstone/claudomator/internal/budget"
+)
+
+type fakeBudget struct {
+	hs  []budget.Headroom
+	err error
+}
+
+func (f fakeBudget) All() ([]budget.Headroom, error) { return f.hs, f.err }
+
+func TestHandleGetBudget_NoBudgetConfigured_ReturnsEmpty(t *testing.T) {
+	srv, _ := testServer(t)
+	req := httptest.NewRequest("GET", "/api/budget", nil)
+	w := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status: want 200, got %d", w.Code)
+	}
+	var hs []budget.Headroom
+	if err := json.Unmarshal(w.Body.Bytes(), &hs); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(hs) != 0 {
+		t.Errorf("want empty list, got %+v", hs)
+	}
+}
+
+func TestHandleGetBudget_ReportsHeadroom(t *testing.T) {
+	srv, _ := testServer(t)
+	srv.SetBudget(fakeBudget{hs: []budget.Headroom{
+		{Provider: "claude", Limited: true, Limit: 10, Spent: 4, Remaining: 6, Fraction: 0.6},
+	}})
+	req := httptest.NewRequest("GET", "/api/budget", nil)
+	w := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status: want 200, got %d", w.Code)
+	}
+	var hs []budget.Headroom
+	if err := json.Unmarshal(w.Body.Bytes(), &hs); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(hs) != 1 || hs[0].Provider != "claude" || hs[0].Remaining != 6 {
+		t.Errorf("unexpected headroom: %+v", hs)
+	}
+}
+
+func TestHandleGetBudget_ErrorReturns500(t *testing.T) {
+	srv, _ := testServer(t)
+	srv.SetBudget(fakeBudget{err: errors.New("db down")})
+	req := httptest.NewRequest("GET", "/api/budget", nil)
+	w := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(w, req)
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("want 500, got %d", w.Code)
+	}
+}