Wire the run: one trace per run, recovery, verification, outputs

The CLI opens the firstrun.run WORKFLOW trace around reading the docs, planning, every step and verification, so one run is one neatlogs trace. Recovery and model-free verification are on by default, with --no-recover for Layer 1 runs. patch.diff and pr_body.md are written after a verified docs patch. Cost counts cache reads at 0.20 USD per million tokens, list price. Containers get the secrets allowlist only.