feat(rustd): the context budget resolves per field, and independently

Ported from `fleet/context_resolve.zig`. Each knob resolves on its own: an
authored value wins, a sentinel inherits from the provider the tenant resolved,
and anything still unset falls to a static default.

The independence is the property, so two of the tests ARE the asymmetry — a
fleet pinning its model while inheriting its cap, and the reverse. A coupled
implementation passes either one alone, which is why both directions are
asserted rather than one.

Order is load-bearing: the overlay runs before `tool_window` is derived, so an
inherited cap feeds the tiering. Without it a fleet that authors nothing lands
on the mid tier whatever model it ends up running.

The tier table is expressed RELATIVE to its boundary constants rather than as
re-typed literals — `CAP_LARGE_TOKENS - 1` and `CAP_LARGE_TOKENS`, not 999_999
and 1_000_000. That is what the boundary test is actually claiming
(inclusivity), it cannot drift when a tier moves, and it is what the UFS gate
asks for; the gate caught the literal, which is the known trap the handoff
records about numeric suspects inside test blocks.

An unresolved cap stays zero rather than being guessed. The runner's chunking
needs a real one and must stay inert instead of acting on a number nobody
established — and the auto window takes the MIDDLE tier there, because the cap
is unknown rather than known to be small.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>