feat(role): add versioned role configs + escalation ladder + scheduler (Phase 5)

Two parts:

Part A (fixes a gap from Phase 1): Groq/OpenRouter/OpenAI were documented in
docs/api-keys-setup.md as usable once configured, but nothing actually
constructed runners for them. internal/cli/cloudrunners.go consolidates
anthropic/google/groq/openrouter/openai NativeRunner construction into one
table-driven registerCloudRunners() helper, replacing the two hand-written
per-provider blocks in serve.go/run.go. Groq/OpenRouter/OpenAI reuse
openaicompat (no new adapter code) at SandboxKind: "docker".

Part B: the token-husbanding harness's core routing mechanism.

- internal/role: RoleConfig/Tier/Rung -- a role's system prompt and a
  multi-tier (provider, model) escalation ladder, versioned via config_json.
- storage: new role_configs table (draft/active/retired, UNIQUE(role,
  version)) with transactional activate-retires-prior-active semantics;
  new executions.escalation_rung column.
- task.AgentConfig.Role string -- purely additive; every existing task shape
  (Agent.Role == "") is unaffected, proven by TestPool_Execute_NonRoleTask_Unaffected
  plus the full pre-existing suite passing unchanged.
- executor.Pool.execute(): role-typed tasks with no Agent.Type yet resolve
  tier 0 of their active ladder (round-robin across multi-candidate tiers,
  skipping rate-limited providers, falling back to soonest-clearing) before
  the existing pickAgent/Classifier path runs; SystemPrompt applies to
  Agent.SystemPromptAppend. Already-resolved role tasks (scheduler resubmits)
  get their escalation_rung re-derived read-only via findTierIndex.
- internal/scheduler: polls role-typed FAILED tasks, retries at the same
  rung under MaxRetries or escalates to the next tier's first candidate when
  budget.Accountant.Allow() permits (emitting event.KindEscalated), else
  leaves the task FAILED with a final:true KindEscalated event. An
  in-memory per-execution-ID "handled" set keeps the poll loop convergent.
  Started by `serve` only, config knob [scheduler].poll_interval_seconds.
- internal/api: POST/GET /api/roles/{role}/versions, POST
  /api/roles/{role}/activate -- unauthenticated, matching the existing
  projects/tasks REST endpoints' auth posture (only chatbot MCP, agent MCP,
  and WebSocket are api_token-gated in this codebase today).

Documented as stored-but-not-yet-enforced (CLAUDE.md Design Debt, matching
how task.Priority/RetryConfig are already documented): RoleConfig.Tools/
SandboxKind don't affect dispatch yet; DefaultBudgetUSD is read narrowly as
the scheduler's escalation cost estimate, not enforced at initial dispatch;
scheduler escalation always targets Candidates[0] (no round-robin, unlike
initial-dispatch tier-0 resolution); the scheduler's dedupe is per-process
and resets on restart (idempotent, harmless).

go build/vet/test -race -count=1 all pass, 21 packages.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1moSNCJRcP6kykA4tyUSs

1 files changed, 4 insertions, 36 deletions

diff --git a/internal/cli/run.go b/internal/cli/run.go
index 34c3d42..08bfb68 100644
--- a/internal/cli/run.go
+++ b/internal/cli/run.go
@@ -6,12 +6,9 @@ import (
 	"os"
 	"os/signal"
 	"syscall"
-	"time"
 
 	"github.com/spf13/cobra"
 	"github.com/thepeterstone/claudomator/internal/executor"
-	"github.com/thepeterstone/claudomator/internal/provider/anthropic"
-	"github.com/thepeterstone/claudomator/internal/provider/google"
 	"github.com/thepeterstone/claudomator/internal/provider/openaicompat"
 	"github.com/thepeterstone/claudomator/internal/storage"
 	"github.com/thepeterstone/claudomator/internal/task"
@@ -119,39 +116,10 @@ func runTasks(file string, parallel int, dryRun bool) error {
 		}
 	}
 
-	if pc, ok := cfg.Providers["anthropic"]; ok && pc.APIKey != "" && cfg.Runners.AnthropicEnabled() {
-		timeout := time.Duration(0)
-		if pc.TimeoutSeconds > 0 {
-			timeout = time.Duration(pc.TimeoutSeconds) * time.Second
-		}
-		runners["anthropic"] = &executor.NativeRunner{
-			Provider:     anthropic.New(pc.APIKey, pc.Endpoint, timeout),
-			Logger:       logger,
-			LogDir:       cfg.LogDir,
-			DefaultModel: pc.DefaultModel,
-			// See internal/cli/serve.go: native cloud providers get
-			// sandbox.DockerSandbox rather than the weaker HostSandbox.
-			SandboxKind:  "docker",
-			SandboxImage: cfg.SandboxImage,
-		}
-	}
-
-	if pc, ok := cfg.Providers["google"]; ok && pc.APIKey != "" && cfg.Runners.GoogleEnabled() {
-		timeout := time.Duration(0)
-		if pc.TimeoutSeconds > 0 {
-			timeout = time.Duration(pc.TimeoutSeconds) * time.Second
-		}
-		runners["google"] = &executor.NativeRunner{
-			Provider:     google.New(pc.APIKey, pc.Endpoint, timeout),
-			Logger:       logger,
-			LogDir:       cfg.LogDir,
-			DefaultModel: pc.DefaultModel,
-			// See internal/cli/serve.go: native cloud providers get
-			// sandbox.DockerSandbox rather than the weaker HostSandbox.
-			SandboxKind:  "docker",
-			SandboxImage: cfg.SandboxImage,
-		}
-	}
+	// Native cloud providers (anthropic/google's own wire formats, plus
+	// groq/openrouter/openai via the OpenAI-compatible adapter) — see
+	// internal/cli/cloudrunners.go.
+	registerCloudRunners(runners, cfg, logger, cfg.LogDir)
 
 	pool := executor.NewPool(parallel, runners, store, logger)
 	pool.Classifier = &executor.Classifier{