fix(pipeline): no pipeline-level token budget or cost ceiling

[harperreed]

Summary

The pipeline engine has no aggregate token budget, cost ceiling, or wall-clock timeout across all nodes. Individual nodes have MaxTurns and retry limits, but the pipeline as a whole can consume unbounded API spend.

Impact

The megaplan.dip example runs 30+ LLM-powered nodes across three providers. Combined with max_restarts (default 5) and max_retries (default 3) on every node, a misconfigured pipeline has multiplicative cost exposure with no circuit breaker.

Recommendation

Add optional pipeline-level limits:

• max_total_tokens: aggregate token cap across all nodes
• max_cost: dollar/cent cost ceiling
• max_wall_time: overall pipeline timeout
• Circuit breaker that halts execution when any limit is hit

Sources

Found by: OpenAI Researcher (expert panel review)