refactor(quota): bound capability gate CLI candidates

[huangruiteng]

Summary

• compact default quota should-run capability-gate candidates into bounded typed anchors after the full decision is computed
• retain candidate identity/order, missing-capability diagnostics, owner action, and gate decision fields
• add --include-capability-gate-detail as the explicit full-candidate cold path and register its output-budget variant

Stack

• base: fix(quota): bound user todo diagnostics #2512 (codex/quota-user-summary-budget-20260724)
• this PR contains only the capability-gate output-budget slice

Validation

• pytest -q tests/control_plane/test_quota_cli_projection.py tests/control_plane/test_cli_output_budget.py (15 passed)
• ruff check on all five changed Python files
• loopx canary premerge --from-git-diff (17/17 passed)
• real loopx-meta default/detail comparison: 46,066 -> 44,493 bytes; interaction_contract, scheduler_hint, selected_todo, and gate action/owner/missing fields remained equal
• git diff --check and public/private boundary scan passed

No failures or skips. No benchmark launch, scoring change, permission change, scheduler mutation, or private evidence is included. The coverage exercises the pure projection contract, CLI flag round trip, budget manifest, and risk-matched control-plane smokes.