bug(pi): enforce applied maxTokens in normalized usage

[drewstone]

Observed

A real Braid /ask run used CLI Bridge with Pi 0.83.0 and pi/tangle-router/glm-5.2.

The profile materialization receipt reported:

• reasoningEffort.requested: none
• reasoningEffort.applied: off
• inference.appliedMaxTokens: 16384

The completed call then reported 1,856 prompt tokens and 20,480 completion tokens.
The downstream bounded model proxy correctly rejected it because 20,480 exceeded the declared 16,384 limit.

Exact public error:

optimizer model execution reported 20480 completion tokens, exceeding requested limit 16384

CLI Bridge currently maps Pi usage.output directly to OpenAI completion_tokens and does not expose separate reasoning usage.

Expected

• A call with appliedMaxTokens: 16384 must not report more than 16,384 visible completion tokens.
• If Pi or the provider includes reasoning in usage.output, normalize visible output and reasoning separately when evidence permits.
• Do not relabel or subtract tokens without provider evidence.
• Keep the materialization receipt and normalized usage internally consistent.

Acceptance

• Add a Pi backend test where reported output exceeds the applied profile cap.
• Add a reasoning-usage fixture if Pi exposes separate reasoning data.
• Fail with a typed upstream/protocol error when the provider violates the applied cap.
• Preserve cost totals and secret redaction.