feat: add review effort accounting and budget governor

docs/architecture.md

@@ -18,6 +18,7 @@ review_pr facade/orchestrator
    │   ├── opencode_workspace  archive, sanitization, brief, factory
    │   ├── opencode_lens_config reviewer configuration and selection
    │   └── opencode_synthesis  normalization, deduplication, summaries
+   ├── review/budget        trusted limits and cumulative accounting
    ├── review parsing      normalize findings + validate anchors
    ├── feedback            persist reactions and derive scores
    └── langfuse_trace      usage, cost, evaluation telemetry
@@ -50,6 +51,10 @@ The internal seams are deliberately narrower:
   transport works.
 - `langfuse_trace` is an optional sink. It is fail-open and cannot change the
   review result.
+- `review/budget` owns deployment and repository resource limits. The runner
+  streams model events and terminates the subprocess after a completed step
+  crosses a step, token, duration, or equivalent-cost limit. Cap status is
+  retained in review output and Langfuse metadata.
 
 ## Trust model