fix: address verified gadfly P3 review (3-cloud fleet)

All 3 cloud models converged on a real access-control bug; fixed it + the
other genuine findings (the false-positives were dropped):

Security (HIGH — all 3 models):
- create_file_url skipped ValidateScope: a same-skill caller could mint a
  PUBLIC url for a file scoped to another user/run. Now runs ValidateScope
  (admin-aware), skipped only for the descendant-grant case — mirroring the
  read tools.

Other real fixes:
- ValidateScope hard-coded `false` at every call site (admin branch dead) ->
  pass inv.CallerIsAdmin (the executor sets it via the host AdminPolicy; still
  false/fail-closed when no admin). Stale "no admin flag" comment corrected.
- create_file_url: ExpiresInSeconds clamped BEFORE the *time.Second multiply
  (huge values overflowed to a negative duration that slipped under the cap,
  minting already-expired tokens); swallowed json.Marshal error now returned.
- RegisterMeta: build the default budget WITH the configured MaxPerRun (was
  NewInMemorySearchBudget(nil) -> hardcoded 10, ignoring MetaDeps.MaxPerRun).
- classify: all-zero scores no longer return a false-positive top-1 winner;
  coerceClassifyScore uses strconv.ParseFloat (rejects trailing garbage like
  "50extra" that fmt.Sscanf silently accepted).
- file_delete: honor the descendant grant (parent can clean up a worker's
  artifacts) — was the lone cross-skill-reject-outright file tool.
- meta tools: input caps truncate at a UTF-8 rune boundary (truncateUTF8), not
  mid-rune.
- think: removed the dead `var _ = fmt.Errorf` import-keeper; file_save default
  aligned to 16 MiB (matched RegisterStore).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tools/tools.go

@@ -55,15 +55,22 @@ func RegisterMeta(reg tool.Registry, d MetaDeps) error {
 	if d.Helper == nil {
 		return errors.New("tools: MetaDeps.Helper is required for the meta tools")
 	}
-	if d.Budget == nil {
-		d.Budget = NewInMemorySearchBudget(nil)
-	}
 	if d.MaxPerRun <= 0 {
 		d.MaxPerRun = 10
 	}
 	if d.MaxWords <= 0 {
 		d.MaxWords = 200
 	}
+	if d.Budget == nil {
+		// Build the default budget WITH the configured per-run cap so
+		// MetaDeps.MaxPerRun is honored — an empty caps map would fall back to
+		// the budget's hardcoded default and silently ignore MaxPerRun.
+		d.Budget = NewInMemorySearchBudget(map[string]int{
+			"classify":         d.MaxPerRun,
+			"extract_entities": d.MaxPerRun,
+			"summarize":        d.MaxPerRun,
+		})
+	}
 	cfg := fixedMetaConfig{maxPerRun: d.MaxPerRun, maxWords: d.MaxWords}
 	return registerAll(reg,
 		NewClassify(d.Helper, cfg, d.Budget),