fix(queue): enforce cumulative capture budget before initial GitHub queries

[seonghobae]

Reliability / resource-control defect

Existing single-writer PR #1707 bounds each gh subprocess to 30 seconds and caps retained stdout/stderr, and capture_pr_queue_snapshot() declares a cumulative capture_budget_seconds. However the repository, open-PR identity, and PR-history queries are still launched unconditionally before the first deadline check. A configured or nearly exhausted cumulative budget can therefore be exceeded while two additional live GitHub commands are started, so the package-owned cumulative budget is not actually enforced across the full capture sequence.

This is queue-governance capture control only. It does not change GitHub branch policy, model/estimator/scoring behavior, or psychometric/statistical arithmetic.

Required RED → GREEN contract

• Extend only existing PR 🛡️ Sentinel: [HIGH] 서브프로세스 파이프 제한 및 DOS 취약점 수정 #1707 / sentinel-bounded-capture-pr-queue-12849572520891612615; do not create a competing queue-capture branch.
• Add deterministic fail-first coverage with an injected monotonic clock proving that after one initial live query consumes the configured cumulative budget, no subsequent identity/history/detail/base query starts.
• Check the package-owned deadline before every live capture command, including repository, identity, and history queries; preserve the existing rule that an already-started command is governed by its own per-command timeout.
• Emit one stable package-owned cumulative-budget error and stop further live capture work once the budget is exhausted; do not duplicate budget errors for commands intentionally skipped after exhaustion.
• Preserve existing open-PR cap, split enrichment, transient 502/503/504 retry policy, subprocess output ceilings, malformed-payload handling, atomic snapshot publication, and exact command-error return codes.
• Do not weaken required workflows or review policy.