feat(runner): zero-trust cost re-metering + crash-safe whole-repo output

[isPANN]

What

Two related runner improvements: meter cost from token usage × declared price (not a self-reported total), and make whole-repo runs durable so an early-stop/crash keeps the bugs already found.

Changes

Zero-trust cost metering (mirrors the existing zero-trust bug re-verification)

• Submissions now carry usage_totals (the 4 billed token buckets: input / output / cache_read / cache_write) + the declared prices snapshot.
• The backend recomputes total_cost_usd and the efficiency metrics from usage_totals × prices and ignores the self-reported total. Legacy submissions without these fields fall back to the reported figure.
• whole-repo now surfaces its session-level 4-bucket usage (was dropped on the floor).

Whole-repo durability

• The agent appends each certificate to TRAJECTORY_DIR/certs.txt the moment it finds it (new {{certs_file}} prompt slot); the runner harvests certificates from both the trajectory and that disk log (deduped by rule+source).
• Fix trajectory loss: output_path was unset and trajectory_dir was never passed, so the --rm'd container dropped the whole trajectory. Both are now wired, and output_path makes mini-swe-agent persist the trajectory after every step (crash-proof). TRAJECTORY_DIR is exposed as a config knob.

Versioned output

• submission.json stays the stable "latest" pointer (prb submit reads it); every run also writes submission-<model>-<timestamp>.json beside it, so runs don't clobber each other.
• Envelope self-describes its run: adds usage_totals, prices, agent_mode.

Docs / schema / tests

• submission.env.example, the run-benchmark skill (field table + SKILL.md), and both JSON schemas updated.
• Added tests for cost re-metering (a bogus self-reported total is overridden), (de)serialization round-trips, and disk-log cert recovery. 176 passed.

Notes

• Backwards compatible: all new envelope fields are additive/optional; the budget-cap enforcement path is unchanged.
• Requires a runner image rebuild to take effect (benchmark/ + config_repo.yaml are baked in).

🤖 Generated with Claude Code