feat(cloud): enforce host governance budgets

tests/test_cloud_governance.py

@@ -132,6 +132,24 @@ def test_governance_routes_persist_revisioned_policies(tmp_path) -> None:
         assert host_policy.json()["revision"] == 1
         reread = client.get("/v1/hosts/host-a/governance-policy")
         assert reread.json()["daily_token_budget"] == 1000
+        conflict = client.put(
+            "/v1/hosts/host-a/governance-policy",
+            json={
+                "max_active_tasks": 3,
+                "daily_token_budget": 1000,
+                "expected_revision": 1,
+            },
+        )
+        assert conflict.status_code == 200
+        stale = client.put(
+            "/v1/hosts/host-a/governance-policy",
+            json={"max_active_tasks": 4, "expected_revision": 1},
+        )
+        assert stale.status_code == 409
+        usage = client.get("/v1/hosts/host-a/token-usage")
+        assert usage.status_code == 200
+        assert usage.json()["used_tokens"] == 0
+        assert usage.json()["daily_token_budget"] == 1000
     finally:
         database.close()