fix: eliminate proxy-fanout signal that triggers free_mode_run_fanout refusal

[ItszFinn]

Summary

This PR fixes the free_mode_run_fanout refusal that was killing client turns with a dead 502 upstream_unavailable. The root cause was that the proxy was producing the exact "proxy fanout" shape upstream classifies as ban-grade evidence (freebuff-spend-ceilings.ts).

Changes

client_id per run (not per call)

The CLI mints client_id once per prompt (run.ts:722/822) and reuses it on every LLM step. The proxy was drawing a fresh client_id per chat call, making one run_id fan out across N client_ids — the exact anti-pattern upstream refuses. Now ClientID is minted once by the run manager and threaded through the envelope.

Dropped prewarm fleet

Pool.Start no longer fans out a run per registry agent per token at boot. That fleet held ~one concurrent agent run per served model on a single free account — the "proxy fanout" sweep signal. Runs now START lazily on first Acquire.

free_mode_run_fanout → 429 (was 502)

The upstream refusal body {"error":"free_mode_run_fanout","message":"Free mode request rejected."} was falling through to the generic UpstreamError branch → dead 502. Now classified as RateLimitError with bounded FanoutCooldown (60s) and surfaced as 429 so clients back off. Never re-POSTs into a fanout refusal.

Luna retired root override

openai/gpt-5.6-luna's root agent was retired upstream (free_mode_legacy_luna_agent). Added retiredRootOverrides map: base2-free-luna → base3-free-luna.

ScarceSessionError accuracy

Now reports the HELD session's model (not the requested one) for correct Retry-After hints.

Run persistence fix

ClientID is persisted with the run so a restart doesn't split a run's identity.

Build tags

Makefile and Taskfile use -tags dashboard for Go builds.

Tests

All 24 test suites pass. New tests:

• TestChatRunFanoutSurfaced429 — end-to-end: fanout body → 429 + Retry-After, one chat call only
• TestChatClientIDStableAcrossRun — same client_id across calls on one run
• TestInjectEnvelopeClientIDPerRun — envelope repeats the run's client_id
• TestClassifyRunFanout — fanout body classified as RateLimitError on any status
• TestRetiredRootOverrideAppliesToBothPaths — offline and live-parse paths agree
• TestStartDoesNotFanOutAndShutdownDrains — no boot fleet, drains one lease

[trefeon]

Verified locally on pr-207: go build -tags dashboard clean, gofmt clean, full hermetic suite passes (env -u AUTH_TOKENS -u ADMIN_TOKEN go test ./...). The per-run client_id threads through both pooled and bridge paths via the shared chatAttempt; the fresh-draw fallback covers runless callers (admin smoke ping). Merging.