feat(engine): Phase 4 — scheduler tick, gate chain, platform git, budget

The AI workforce engine's driver. One tick moves every ready task one step:
a turn, a gate, or a platform merge. The AI never runs git.

- scheduler.py: tick() over TURN_STAGES/MERGE_STAGES; selection caps
  (per-org 3, global 8); optimistic advance so two workers cannot both win;
  worktree created for code pipelines, released on completion/cancel/failure
  (kept during error_review); budget pause before any turn is spent; merge
  conflict back-off; transient-failure retries then the manager's error turn.
- gates.py: diff guard (empty/.git/CI/symlink/oversize), no-progress hash,
  tests in the sandbox, green gate that only trusts a green tests row or an
  explicit waiver. Every verdict is a gate_results row + a task.gate event.
  Fixed forbidden_paths: lstrip("./") stripped all leading dots, hiding
  .git and .github from the guard.
- container_engine.build_scheduler + worker drives the engine tick.
- ManagerOutcome.error_kind; TaskSpendRepository.spend_for_task.
- New settings engine_max_concurrent_turns, engine_max_turns_per_org,
  engine_tests_timeout_seconds, engine_max_merge_conflicts,
  engine_max_task_credits (+ .env.example).
- tests: test_engine_gates.py (13), test_engine_flow.py (11).

Checks: pytest 746 passed/1 skipped, ruff clean, mypy clean (160 files).

apps/api/app/core/config.py

@@ -149,6 +149,16 @@ class Settings(BaseSettings):
     #: the turn timeout, hundreds of paid calls later.
     engine_max_protocol_retries: int = 3
     engine_turn_timeout_seconds: int = 900
+    #: Scheduler concurrency: turns running at once, globally and per org.
+    engine_max_concurrent_turns: int = 8
+    engine_max_turns_per_org: int = 3
+    #: The tests gate's own budget, and how often a merge may conflict before
+    #: the manager takes over.
+    engine_tests_timeout_seconds: int = 600
+    engine_max_merge_conflicts: int = 3
+    #: Per-task credit ceiling (0 = no ceiling). Checked before every turn:
+    #: an organization that ran out of credit is paused, not left spinning.
+    engine_max_task_credits: float = 0.0
     engine_max_cycles: int = 6
     engine_max_employees: int = 20
     engine_tick_seconds: float = 10.0