0.37.0

Added

• protocol drive run now refuses maps with model steps before allocating a run unless METAHARNESS_LIVE=1, --budget-usd and --assume-usd-per-run explicitly authorize them. It records exact integer-microdollar reservations before each metaharness spawn, stops with the typed budget-exhausted run outcome before a launch would cross the cap, and makes resumes inherit or narrow—but never raise—the remembered ceiling. Command-only maps remain free.