[AIGTWY-4880] Add a reversible budget fixture for CUJ5

[andy-xu-db]

🥞 Stacked PR

• stack/andy/aigtwy-4880-account-auth [Files changed]
  • stack/andy/aigtwy-4880-budget-fixture [Files changed] ← this PR
    • stack/andy/aigtwy-4880-budget-evidence [Files changed]
      • stack/andy/aigtwy-4880-budget-defaults [Files changed]

---

Summary

Add the reversible account-budget fixture for CUJ5 (AIGTWY-4880). It uses existing positive spend and temporarily changes the per-user hard-block limit to exercise the 50% and 80% smart-default tiers.

Changes

• Read one immutable BudgetTarget from the metadata supplied to pytest and reject a mismatched workspace before requests.
• Validate the published policy, budget scope, and absence of principal overrides before writing.
• Calculate thresholds with Decimal, preserve the complete budget configuration, and verify account and recommendation API readback.
• Restore the original threshold on success or failure, including an update whose response may have been lost.
• Use the account token minted by the runner from the shared CUJ service-principal credentials.

Configuration

PR #911 owns the concrete workspace, account, budget, and model values in .github/workflows/integration.yml. PR #913 forwards them without duplicating those values in the runner or fixture.

Verification

The complete stack passed 119 focused tests. Live CUJ5 verified account-budget mutation and restoration. The update body retains required alert/action IDs, omits response-only fields, and normalizes the legacy BLOCK_USAGE.target returned by GET but rejected by PUT. The principal needs workspace model access, pre-provisioned positive spend, and account budget read/update permission. Setup never generates spend.

[andy-xu-db]

Consolidated into #911, which now contains the complete CUJ5 integration test change as one commit against main.