feat: gate managed Turn host starts by owner cadence

[huangruiteng]

An owner can set a 24-hour automatic execution floor, yet a managed turn run-once host failure or invalid result could start a new model immediately on retry. This change reserves a start atomically in the existing quota policy store before each new managed host attempt. An early retry returns the next eligible time without invoking the host, writing back a result, or spending a quota slot; cached settlement still replays without another reservation.

The store upgrades M1 policy files in place to v2 and retains start records across restart. Goal floors apply per agent, and an automation-specific floor requires a stable --automation-id. An explicit --manual-interval-bypass-reason bypasses only the interval and records the manual start. The CLI renders the interval wait and next eligible time. The English and Chinese RFCs now distinguish this managed Turn candidate from the still-unqualified Codex App timer-to-hook path and other launchers.

Validation: 140 Python Turn/cadence tests; six TypeScript cadence tests covering exact due time, concurrency, restart, scope isolation, manual bypass and M1 migration; focused final CLI/retry tests; TypeScript typecheck, Ruff, public-boundary scan, and exact-head change-quality receipt cqr_a7e80b9285d5ac8e1ad9 passed. The risk-based premerge gate passed all 19 checks with no manual holds. The scoped mypy command has existing errors on main (87) and this branch (84), with no new normalized errors. No live model call or existing automation change was made.

This PR changes the managed CLI entry point and quota/Turn readback. The Codex App schedule recommendation remains the M1 behavior; App pre-model hook coverage and the packaged settings editor are separate acceptance work. No frontend code changes are needed for this managed CLI slice.