v0.24.0

Cloudflare's Clef decision models, over the REST API and (new crate
yoagent-workers) through a Worker's AI binding, plus two fixes. No breaking
changes: DecisionError::RateLimited gains a body field, and the variant is
#[non_exhaustive].

Added

• Cloudflare's Clef decision models (feature decision):
  DecisionModel::clef(account_id) and DecisionModel::clef_flash(account_id)
  call @cf/cloudflare/clef / @cf/cloudflare/clef-flash on Workers AI, which
  speak the SystemOne API. The token is read at call time from
  CLOUDFLARE_API_TOKEN, then CLOUDFLARE_AUTH_TOKEN. Priced from
  prices.json (cloudflare/clef $0.24, cloudflare/clef-flash $0.09 per
  million input tokens) while requests go to api.cloudflare.com. Underneath,
  SystemOneBackend::workers_ai(account_id, model_path) and
  SystemOneBackend::with_endpoint_url(url) (an exact URL). The backend
  unwraps Cloudflare's {"result": ...} envelope and keeps Cloudflare's
  error text: a 429 for a used-up daily allocation (code 3036) is not retried,
  out of capacity (3040) is; a 2xx "success": false is Invalid (schema
  error 5006) or Backend. Tested against a mock server only.
• DecisionError::RateLimited carries the server's body (new field;
  the variant is #[non_exhaustive]), shown in its message, with
  DecisionError::rate_limited_with_body. A SystemOne key read from the
  environment is trimmed, and a 401/403 names the variable it came from.
• decision::parse_systemone_response(body, request): the SystemOne
  response parser SystemOneBackend uses (lenient, Cloudflare's envelope
  unwrapped), public for backends that move the request themselves.
• yoagent-workers (new crate, integrations/yoagent-workers/): yoagent
  on Cloudflare Workers through the Worker's own bindings. First,
  yoagent_workers::ai::{clef, clef_flash, AiBackend} run Clef through the
  Workers AI binding (env.AI) as a DecisionBackend — no API token, no
  account id. Binding errors are read for Workers AI's codes: out of capacity
  (3040) is retried (AiBackend::with_retry), a used-up daily allocation
  (3036) is not. wasm32 only; tested under Node against fake bindings. Not yet on
  crates.io (it needs parse_systemone_response); yoagent's core does not
  depend on it.

Fixed

• A sub-agent's retried attempt is marked in its updates. A sub-agent
  forwards its text deltas to the parent's on_update, including those of a
  provider attempt that then fails and is retried. It now also forwards
  [sub-agent retrying after: <error>] on AgentEvent::ProviderRetry, like
  the existing [sub-agent calling tool: <name>] marker, so the failed
  attempt's partial text is not read as the start of the answer.
• An overflow reported by an empty 400/413 body is detected on the
  message. Cerebras and Mistral answer an oversized request with an empty
  400/413, which ProviderError::classify already treats as
  ContextOverflow. But the turn's recorded error ("Context overflow: ")
  holds no overflow phrase, so Message::is_context_overflow() returned
  false for it. It now recognises any turn that ended with a
  ContextOverflow error.