feat(ledgerr-cloud): GPU-training cloud budget reconciliation crate + MCP tool

[elasticdotventures]

Summary

Net-new code (not modifying/fixing existing logic). Builds the real GPU-training-budget-reconciliation subsystem that GitHub issues #107–#111 describe prospectively — a prior investigation confirmed nothing in the actual repo implemented it. This is that implementation, ported faithfully from the _b00t_/cloud-budget.tomllmd bash datum's AWS/GCP/Azure/HuggingFace logic (that datum lives in a separate _b00t_ repo and is not accessible from this build; only its documented behavior/defaults were ported).

Phase 1 — crates/ledgerr-cloud (new crate)

• BudgetProvider trait (check_auth / fetch_budget) implemented by AwsProvider, GcpProvider, AzureProvider, HfProvider — each shells out to its already-installed CLI via tokio::process::Command (no cloud SDK deps), parsing real JSON/TSV output shapes with serde_json rather than grep-style matching.
• CloudBudgetConfig: usd_per_cake/monthly_cap_cake/hf_a100_large_rate/warn_threshold/gate_threshold, with CAKE_USD_RATE/CAKE_MONTHLY_CAP env overrides and the datum's documented defaults (10.00 / 2.50 / 0.75 / 0.90).
• ReconcileRunner::run() never propagates a single provider's error out of the run — each provider is caught into a Pass/Fail/Skip ProviderStatus. HF is structurally NoApi (no billing API); its declared, non-authoritative CAKE_MONTHLY_CAP cap round-trips through the report via ProviderStatus.authoritative.
• 19 unit tests, JSON/TSV fixtures under tests/fixtures/. No unwrap() or unchecked indexing in the crate.

Phase 3 — wired into crates/ledgerr-mcp

• New ledgerr_budget MCP tool (single reconcile action), following the repo's real contract.rs/mcp_adapter.rs pattern exactly (tool-name const, action enum wired through tool_input_schema, PUBLISHED_TOOLS/TOOL_REGISTRY entries, a handler in mcp_adapter.rs, a match arm in the stdio server binary) — same shape as ledgerr_focus/ledgerr_manifest.
• ReconcileRunner::run is async; the MCP dispatch loop is synchronous, so the handler drives it on a scratch current-thread tokio runtime.
• Regenerated docs/mcp-capability-contract.md / docs/agent-mcp-runbook.md via the repo's own regen-docs binary; bumped the two hardcoded 12-tool-count assertions to 13.
• New tests/budget_reconcile_tool.rs with a 30s watchdog thread so a slow CLI call can't hang the suite; requires no cloud credentials to pass.

Phase 4 — integration test skeleton

• crates/ledgerr-cloud/tests/reconcile_integration.rs runs the real ReconcileRunner against whatever CLIs/creds exist in-environment; report-shape assertions hold unconditionally, provider-specific "Pass when authenticated" assertions SKIP (not fail) via the same env-var-guard convention already used in crates/ledgerr-mcp/tests/mcp_provider_smoke.rs. Full-green requires the human-only auth steps tracked in the Phase 2 tracking issues — see feat: expose BudgetProvider reconcile via ledgerr-mcp MCP tool #111.

Verification (PASS evidence, verbatim)

$ cargo check -p ledgerr-cloud
    Checking ledgerr-cloud v1.10.0 (.../crates/ledgerr-cloud)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.30s

$ cargo test -p ledgerr-cloud
test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out   (unit)
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out    (reconcile_integration)
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out    (doctests)

$ cargo clippy -p ledgerr-cloud --all-targets
    Checking ledgerr-cloud v1.10.0 (.../crates/ledgerr-cloud)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.26s   (zero warnings)

$ cargo check -p ledgerr-mcp
    Checking ledgerr-mcp v1.10.0 (.../crates/ledgerr-mcp)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.30s
    (1 pre-existing warning in fbar.rs, unrelated to this change)

$ cargo test -p ledgerr-mcp
test result: ok. 44 passed; 0 failed ... (lib)
... 46 more `test result: ok` integration-test-file results, 0 failed anywhere ...

$ cargo clippy -p ledgerr-mcp --all-targets
    22 pre-existing warnings, all in files/lines untouched by this PR
    (coverage.rs, crypto.rs, capital_loss.rs, feie.rs, lib.rs, bin/ledgerr-mcp-server.rs,
     tests/feie_contract.rs — verified via `git stash` diff before/after)

Refs #111