A budget stop during witness authoring discards the worker's completed change; the degrade-designed stage also carries reachable expects

[macanderson]

Problem

Two fail-closed-too-hard shapes in crates/stella-pipeline/src/pipeline/witness_stage.rs:

1. Budget aborts are rejected (author turn and repair turn arms): witness_on_demand propagates Err, and run_candidate turns it into CandidateResult::aborted(.., DeliberateStop) — the worker's finished diff is thrown away because the scaffolding ran out of money. Invariant 6 (budget aborts at safe boundaries) explains stopping, but stopping and discarding are different: the completed change could finish on the unauthored ladder as Unverified and still respect the budget by suppressing further paid calls. Needs a design decision — the interaction with the verify loop's own paid calls is the hard part (degrading the witness but then buying verdict calls would overspend).
2. Reachable expect()s in the one stage whose contract is "degrade, never discard": baseline.workspace.expect("witness authoring requires a pristine baseline workspace"), the grafting expect, and the identity expects. Each is caller-upheld today; a future caller wiring CandidateSurface { workspace: None } panics the run instead of losing a witness. Typed degradable aborts fit the file's own WitnessAbort vocabulary.

(The sibling misclassification — author created no file → was rejected — was fixed separately with WitnessArtifactError::NothingCreated; this issue is the remaining two.)

Verify

1: scripted run whose budget exhausts exactly during witness authoring currently returns an aborted candidate; after the fix it completes Unverified with the witness unproven and no further paid calls. 2: a CandidateSurface with workspace: None reaching witness_stage degrades instead of panicking.

[macanderson]

Triage 2026-08-06: P1 — a budget stop during scaffolding discarding the worker's completed, paid-for diff loses real work on a shipped path, and the reachable expect()s contradict the stage's own degrade-never-discard contract. Plan: as specced in the body; next step is the design decision on sub-issue 1 (complete Unverified while suppressing further paid calls, resolving the verify-loop overspend interaction) — sub-issue 2's typed WitnessAbort variants then follow mechanically.

[macanderson]

Partial fix in #1890: budget stops during witness authoring/repair are now degradable (the worker's completed change survives; the budget guard still gates every later paid call so no overspend is possible), and the stage's two workspace expects became degradable aborts. Remaining scope: the end-to-end scenario proving a budget-stopped witnessed run completes on a deterministically-resolvable ending (warranted waiver / abstention) with zero further paid calls — needs the tool-calling scripted harness, since the interesting shapes require dispatched mutating calls.