agents: migrate Maestro to dspy-go v0.86

[XiaoConstantine]

Summary

• upgrade Maestro from dspy-go v0.83.1 to v0.86.0
• replace removed native trace APIs with canonical agents.ExecutionTrace
• use ExecuteWithTrace so outputs, source extraction, confidence, and accounting share one operation-scoped trace
• record native QA token usage in Maestro's budget manager
• update tests and migration documentation for the typed API

Battle testing

A live native maestro-probe run against a tiny repository fixture completed through Gemini and returned the expected answer and source:

• answer identified WidgetLoop in pkg/runtime/loop.go
• canonical trace usage reached Maestro budget metadata
• budget_total_tokens was non-zero
• ask.native recorded exactly one call

A larger live run against dspy-go also exercised eight native turns and canonical source extraction. It exposed Maestro-side budget accounting debt, fixed in this PR by recording the operation-scoped trace. No dspy-go v0.86 execution defect was observed.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• golangci-lint run --new-from-rev=origin/main ./...
• go mod tidy -diff
• git diff --check
• removed API/reference sweep

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[XiaoConstantine]

CI note: both golangci-lint checks run the full repository with version: latest and fail on the existing main-branch lint backlog (ineffassign/staticcheck/unused findings outside this PR). The same lint workflow already fails on current main (d9955a4, run 29753587469). golangci-lint run --new-from-rev=origin/main ./... reports 0 issues for this migration.