fix(runtime-host): serve one revision-consistent Usage snapshot #4058

Problem

Desktop now reads Settings > Usage from the selected Runtime Host, but one page load issues independent summary, log, and pricing queries. The wire contract has no snapshot identity or revision, and the Desktop adapter currently accepts a degraded result if repair or Host replacement makes those reads disagree. One rendered page can therefore mix revisions.

Scope

• Add a bounded opaque snapshot ticket to the Runtime Host Usage query contract.
• Return one authoritative revision with Usage summary and page results.
• Pin a bounded Host repair/read pass to that ticket and return a typed revision-changed error when it cannot be honored.
• Make Desktop retry the whole Usage load a bounded number of times instead of mixing partial revisions.
• Add protocol, coordinator, and Desktop adapter tests.
• Raise RUNTIME_HOST_COMPATIBILITY_EPOCH strictly above the value on main when the wire change lands.

Non-goals

• Usage UI redesign or coverage-state presentation.
• Pricing mutation semantics.
• Rewriting Runtime Host repair authority.
• Removing the legacy Storage Usage reader.
• Adding another durable Usage authority.

Acceptance

• Summary, model logs, tool logs, and pricing used by one Desktop load are revision-consistent or the load fails/retries as one unit.
• Retry and snapshot lifetime are bounded.
• A Host replacement cannot silently combine old and new results.
• Compatibility tests cover old/new epoch rejection and the typed revision-change path.

Related

• Usage hides model attempts without token data and marks interrupted tools as successful #2128 tracks missing/partial/unpriced/aborted coverage and presentation.
• fix(desktop): read Usage from Runtime Host #2641 is the superseded broad implementation branch.