feat(agent): ship no task limits; the spend gate is opt-in

[esengine]

Follow-up to #8320, which dropped the round ceiling but kept a 30-minute wall-clock default. That default goes too.

What changes

Nothing bounds an ordinary chat task by default - not rounds, not tokens, not time, not money. It runs until the model finishes, an adaptive guard finds it stopped making progress, or the user stops it.

Why no default survives

Deciding a task has run too long is a judgement only the user can make:

• Money does not survive a model switch. A budget loose enough for DeepSeek lands a frontier model within a couple of answers. There is no portable amount.
• A long task is as often the job as it is a runaway. An hour of work on a deliberately large task is not a defect, and a default that lands it is a default that fires on real work - worse than no default at all.

That leaves the gate as what it should have been from the start: available, precise, and off until asked for.

The gate is unchanged

[agent]
task_cost_budget = 5.0            # in the model's pricing currency
task_time_budget_minutes = 60     # wall clock across the whole task

Each axis is independent, scoped to a whole task (every "continue" included, until unrelated work resets it), and lands on one tool-free summary plus a resumable pause. Cost still only judges what it can price. taskBudgetOrDefault becomes normalizeTaskBudget, which now does nothing but read a negative value as unset.

Verification

• TestUnconfiguredBudgetNeverCrosses pins the promise directly: eight hours and 55M tokens against an unconfigured budget cross nothing
• TestTaskBudgetShipsNoLimits - both axes off out of the box
• TestTaskBudgetAxesSetIndependently - setting one does not imply the other
• The gate's own tests are unchanged and still green, since they configure a budget explicitly: TestTaskBudgetGateLandsARunawayOnCost, TestTaskBudgetGateFiresOnWallClock, TestTaskBudgetGateKeepsTheWorkAndAsksForASummary, TestTaskBudgetGateIgnoresCostWhenUnpriced
• TestEffectTaskBudgetLandsARunawayThroughRealBuild still passes through the real boot.Build stack - it configures the budget in TOML, which is now the only way it applies

go test -count=1 ./internal/agent/ ./internal/control/ ./internal/boot/ ./internal/config/ green; golangci-lint run ./... 0 issues; repolint clean with no baseline change (this removes lines).

Cache-impact: none - removes a default from host-side budget normalization. No prompt, tool schema, or provider request field changes.
Cache-guard: existing - go test ./internal/agent/ covers the cache-hit e2e suites, green unchanged.
System-prompt-review: needed - touches internal/config/ (comment only) and internal/boot/ indirectly via defaults. No key is added or removed and nothing reaches the system-prompt prefix; requesting review from @esengine as config owner.
Documentation-impact: updated - docs/GUIDE.md and docs/GUIDE.zh-CN.md now state that a chat task has no default limit of any kind and that the spend gate is opt-in.