feat(cloud): add targeted task governance foundation

openspec/changes/cloud-console-governance/specs/cloud-planner-proxy/spec.md

@@ -0,0 +1,38 @@
+## ADDED Requirements
+
+### Requirement: Planner proxy enforces effective Host token budgets before provider invocation
+The Cloud planner-decision endpoint SHALL atomically reserve a conservative
+bounded token amount before invoking its provider for an authenticated Host
+using Cloud planner transport with an effective token budget, and SHALL reject
+the request without invoking the provider when the reservation would exceed
+the remaining budget.
+
+#### Scenario: Budget permits a planner decision
+- **WHEN** the Host has sufficient budget after used and reserved tokens are
+  considered
+- **THEN** the endpoint creates a reservation and invokes the configured
+  provider exactly once
+
+#### Scenario: Budget is exhausted
+- **WHEN** a next planner decision would exceed the Host's effective budget
+- **THEN** the endpoint returns a structured failure without invoking the
+  configured provider
+
+### Requirement: Planner proxy settles provider-reported token usage without persisting prompts
+The Cloud planner-decision endpoint SHALL settle its reservation to the
+provider-reported token usage when available and SHALL retain only non-secret
+metering metadata, never the raw prompt, screenshot, provider credentials, or
+session/lease secret.
+
+#### Scenario: Provider response includes usage
+- **WHEN** the configured provider returns a valid tool-call decision and
+  token-usage metadata
+- **THEN** the endpoint records and returns the decision, settles the Host's
+  reservation to the reported usage, and does not durably store request text
+  or screenshot bytes
+
+#### Scenario: Usage is indeterminate after failure
+- **WHEN** a reservation exists but the endpoint cannot determine provider
+  usage after a transport failure
+- **THEN** the reservation remains until bounded expiry cleanup rather than
+  being released as unused