orb(cost): no per-repo AI ceiling on the self-host path, and the global cap is denominated in the wrong unit

[JSONbored]

AI_DAILY_NEURON_BUDGET (src/services/ai-review.ts ~2504-2510) is the only global ceiling, and it has three problems:

1. Non-binding default. Clamp max is 10_000_000, and an unset/NaN value falls back to that maximum (the #budget-no-starve fail-safe). At roughly 20k neurons for a full block-mode review (~4k for the review legs plus up to ~16k reserved for the tie-break judge, per estimateNeurons ~606-616) that permits ~500 full reviews per instance per day before anything stops — far above the volume at which the known runaway incident occurred.
2. Wrong unit. "Neurons" is a Cloudflare Workers-AI billing unit with no relationship to the providers ORB actually runs on self-host (claude-code / codex / anthropic). coerceAiUsage already extracts provider-reported costUsd — the cap should be denominated in that.
3. No per-repo ceiling on the path we use. A per-repo daily limit exists only for BYOK (AI_BYOK_DAILY_REPO_LIMIT, ~2525-2544). One runaway repo can consume the entire instance-wide allowance.

Related: src/review/adapters.ts ~117 does const embedAi = env.AI_EMBED ?? env.AI;. With AI_EMBED unset, RAG and impact-map embeddings route onto the frontier review chain. createChainAi rejects embeds for CLI providers (EXPECTED_EMBEDDING_ROUTING_ERRORS, src/selfhost/ai.ts ~1244), but an openai-compatible or anthropic link will serve them at frontier pricing — booked at zero neurons.

Fix

1. Add a per-repo daily call/cost cap on the non-BYOK path, mirroring AI_BYOK_DAILY_REPO_LIMIT.
2. Denominate the global cap in costUsd.
3. Require an explicit AI_EMBED when RAG/impact-map is enabled; refuse to run RAG rather than silently falling back to the review chain.

[linear-code]

JSO-6267