#789 Orchestrator capped at per-LEAF token budget (100k) + budget check on resume drops an already-approved action

run_goal (orchestrator) defaults token_budget to max_tokens_per_leaf (100k) when None -- but that's the per-LEAF cap; the orchestrator carries the full payload (research list duplicated in email body + webhook JSON + replayed message history each turn) and exhausts 100k on a normal multi-action task. Worse: HITL approval suspends+REPLAYS run_goal; on resume after the human approves a tool call, the budget check at the top of run_goal (engine: enterprise/tools/agent.py ~line 659) fires BEFORE re-reaching the approved dispatch -> the approved action is silently dropped with finish_reason=budget. Repro (tenant demo, run 5359339c): research+approve+email+webhook+goodnight; email(action1) and webhook POST(action2) executed and were externally confirmed (emailhook + webhook.site), but the goodnight email (action3) was APPROVED yet never sent -- run ended 'Stopped: token budget exhausted' at turn 5. FIX: (a) an APPROVED action must always execute -- do not abort it on the post-approval resume (check budget BEFORE requesting approval, not on replay into it); (b) the orchestrator should use max_tokens_per_run (12M), not max_tokens_per_leaf (100k) -- leaves keep the per-leaf cap; (c) optionally trim large payloads from the carried message history. NOTE: #787/#788 verified working in the same run (research GETs silent, only the 3 writes gated, no turn-0 bail), golden demos pass.