v0.23.0 — More agents + subagent budget enforcement

Added — 3 more specialist subagents

Follow-up to v0.22.1. Roster now 14: 6 Tier 1 + 8 Tier 2.

• tp-history-explorer — git archaeology. "Why is this like this?" returns the minimum commit chain that explains current state. Refuses to theorise beyond what commit messages actually say.
• tp-audit-scanner — read-only Critical / Important / Minor audit. Grep patterns for secrets / injection / unsafe casts, cross-checked by reading the enclosing symbol. Never edits, never quotes secrets in output.
• tp-session-restorer — rehydrates state after /clear or compaction. Reads .token-pilot/snapshots/latest.md + git status + saved docs list, returns a ≤200-token briefing in a fixed shape.

Added — subagent budget enforcement (TP-q33 part a)

Every tp-* agent declares Response budget: ~N tokens. Until now, nothing enforced it.

• PostToolUse:Task hook reads the frontmatter budget, counts response tokens (chars/4), logs 10%+ overshoots as JSONL to .token-pilot/over-budget.log.
• Scope: tp-* only — third-party agents left alone.
• Zero API cost. Live-harness half (TP-q33b) still deferred; requires ANTHROPIC_API_KEY.

Log shape: { ts, agent, budget, actualTokens, overByRatio }.

Numbers

• 904 tests green (+14 budget hook regression tests), tsc --noEmit clean.
• 14 agents ship in dist/agents/.

Full changelog in CHANGELOG.md.