feat: import governed sandbox commits and enforce native CLI limits

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

rein_aharness/runner.py

@@ -30,6 +30,7 @@ from rein_aharness.repository_transaction import (
     RepositoryTransactionError,
 )
 from rein_aharness.taskspec import TaskSpec
+from rein_aharness.native_limits import NativeLimitError
 
 PROMPT_TEMPLATE = """\
 You are an unattended executor session (agent persona below, if any).
@@ -63,6 +64,7 @@ class RunResult:
     tool_profile: str = ""
     budget_tokens: int | None = None
     tokens_spent: int | None = None
+    cost_usd: float | None = None
     execution_time_s: float = 0.0
     # Real-time per-tool-call audit events, populated only when run_task is
     # called with emit_tool_events=True. See adapter.py's module docstring
@@ -233,11 +235,14 @@ def _execute_locked_task(
         timeout_seconds=spec.timeout_seconds,
         skip_if_exists=False,
         budget_tracker=budget_tracker,
+        model_params={"max_budget_usd": spec.max_budget_usd, "max_turns": spec.max_turns},
     )
 
     started = time.monotonic()
+    cost_usd = None
     try:
         response = adapter.execute_prompt(prompt, config)
+        cost_usd = response.metadata.get("cost_usd")
         session_output = response.content
         resolved_model = response.model
         session_ok = True
@@ -248,6 +253,8 @@ def _execute_locked_task(
         reason = f"execution cancelled ({exc.reason})"
         resolved_model = model
     except Exception as exc:  # adapter / budget failures must still be reported
+        if isinstance(exc, NativeLimitError):
+            cost_usd = exc.cost_usd
         session_output = ""
         session_ok = False
         reason = f"session failed: {exc}"
@@ -273,6 +280,7 @@ def _execute_locked_task(
 
     metric_metadata = {
         "task_title": spec.title,
+        "cost_usd": cost_usd,
         "tool_profile": profile.name,
         "labels": list(spec.labels),
         "completion_event_type": spec.completion_event_type,
@@ -325,6 +333,7 @@ def _execute_locked_task(
         tool_profile=profile.name,
         budget_tokens=budget_tokens,
         tokens_spent=tokens_spent,
+        cost_usd=cost_usd,
         execution_time_s=execution_time_s,
         tool_events=collected_events,
         transaction=transaction_evidence,