feat: add review effort accounting and budget governor

pilot/README-webhook.md

@@ -272,6 +272,14 @@ Set `.pr-review.json: "reviewers": []` to opt out (single-primary fallback).
     { "id": "my-lens",  "agent_file": ".opencode/agents/my-lens.md", "model": "headroom/glm-5.2:cloud" }
   ],
   "triage": { "enabled": true, "max_lenses": 4 },
+  "budget": {
+    "max_steps": 20,
+    "max_total_tokens": 120000,
+    "max_output_tokens": 20000,
+    "max_duration_seconds": 480,
+    "max_lenses": 4,
+    "max_equivalent_cost_usd": 1.00
+  },
   "max_findings": 7
 }
 ```
@@ -285,9 +293,19 @@ files. Fail-open: if triage errors, all lenses run.
 | var | default | effect |
 |-----|---------|--------|
 | `PRAGENT_MAX_PARALLEL_LENSES` | 4 | cap concurrency |
+| `PRAGENT_MAX_REVIEW_STEPS` | 20 | maximum completed model iterations per review |
+| `PRAGENT_MAX_REVIEW_TOKENS` | 120000 | maximum cumulative tokens per review |
+| `PRAGENT_MAX_REVIEW_OUTPUT_TOKENS` | 20000 | maximum generated tokens per review |
+| `PRAGENT_REVIEW_TIMEOUT` | 480 | maximum review duration (s) |
 | `PRAGENT_LENS_TIMEOUT` | 540 | per-lens subprocess timeout (s) |
 | `PRAGENT_REVIEWERS` | unset | force multi-lens fan-out even without `reviewers[]` |
 
+Budget limits can also be set per repository in the trusted base-branch
+`.pr-review.json`. The process terminates after a completed iteration crosses a
+limit, preserves any output already emitted, and records the cap reason in the
+review body and Langfuse metadata. Environment variables provide deployment-wide
+defaults; repository budget values override them.
+
 **Cross-lens dedup:** synthesiser drops duplicates by
 `sha256[:16](path|line|severity|problem[:80])` (matches the feedback DB's
 `posthash`), then promotes multi-lens agreement by one severity step