docs: add subagent tool-budget guardrails for MCP tasks (Closes #259)

Document default tool-call and wall-time budgets for deterministic MCP
work, forbid subagent commit delegation when gitea_commit_files is
available, and pin the rules in runbooks, portable skill, operator guide,
and doc-contract tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

gitea_mcp_server.py

@@ -3483,6 +3483,16 @@ _GUIDE_RULES = {
         "small fixes, review fixes, conflicts, emergencies). Main checkout: "
         "read-only inspect, fetch, create worktrees, post-merge stable "
         "update, explicit repair only."),
+    "subagent_tool_budget": (
+        "General-purpose subagents on deterministic MCP tasks must stay within "
+        "budget: single-step mutations (commit_files, create_pr, lock_issue) "
+        "max 15 tool calls / 5 min; review/merge queue inspection max 40 / "
+        "15 min. The main session with gitea.repo.commit must call "
+        "gitea_commit_files directly — no subagent delegation (#260). After "
+        "shell spawn failure (#258), attempt native MCP once; never authorize "
+        "WebFetch/Playwright/manual base64 when gitea_commit_files is "
+        "available. Never resume a failed subagent into a larger retry loop "
+        "(#259)."),
 }
 
 _COMMON_WORKFLOWS = [