feat(run): single-loop max-steps salvage + enforce MaxToolCalls

Two gaps surfaced by a live fan-out smoke in a downstream host (mort):

1) A single-loop run that exhausts its step budget (ErrMaxSteps / ErrToolLoop)
   returned empty Output + a hard error, discarding all the reasoning it had
   produced — unlike the phased path, which already salvages a partial
   transcript and continues. Add opt-in single-loop salvage
   (Defaults.SalvageSingleLoopMaxSteps, default off): on budget exhaustion with
   empty Output, reconstruct a best-effort answer from the step narration
   (reusing salvagePhaseTranscript) and downgrade the run to a successful
   partial result. Off by default so a structured-output host keeps its clean
   hard error; an interactive host opts in.

2) RunnableAgent carried no tool-call ceiling — MaxIterations bounds STEPS, but
   one step can dispatch several tool calls, so a host's "max tool calls" cap
   had nowhere to land. Add RunnableAgent.MaxToolCalls (<=0 = unlimited,
   backward-compatible): the step observer counts executed calls and, once the
   cap is reached, stepCeilingOption forces the loop to exit; the resulting
   ErrMaxSteps is relabeled to the new ErrMaxToolCalls sentinel. Enforced
   single-loop only for now (phased is a follow-up). A cap hit is budget
   exhaustion, so salvage recovers its partial reasoning too.

isPhaseBudgetExhaustion becomes the shared isBudgetExhaustion (now also matching
ErrMaxToolCalls) so the phased and single-loop paths never drift, and the
RunStateAccessor now reports the real tool-call cap (was hardcoded 0).

Additive + backward-compatible: new optional DTO field, new opt-in Defaults
flag, new exported sentinel; unlimited/off reproduce prior behavior exactly. No
new dependencies (go mod tidy clean). Tests cover salvage on/off/no-prose, cap
enforcement + sentinel, cap+salvage, unlimited no-op, and cap-overrides-critic.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Q1eJh5NVR11z6RzyxLANMK

run/agent.go

@@ -37,6 +37,15 @@ type RunnableAgent struct {
 	MaxIterations int
 	MaxRuntime    time.Duration
 
+	// MaxToolCalls caps the TOTAL number of tool calls across the whole run,
+	// independent of the step ceiling (one step can carry several parallel tool
+	// calls). 0 (or negative) = unlimited — the backward-compatible default, so
+	// a run that never sets it is unaffected. Enforced at step granularity: the
+	// loop stops after the step in which the cumulative tool-call count reaches
+	// the cap, surfacing ErrMaxToolCalls. Single-loop runs only today (phased
+	// pipelines are a follow-up).
+	MaxToolCalls int
+
 	// LowLevelTools are tool-registry names the run may call directly.
 	// SkillPalette / SubAgentPalette name saved skills / sub-agents exposed as
 	// skill__<name> / agent__<name> delegation tools, resolved through