refactor: shared pricing arithmetic module — DSE-1514 round 2 of 4 (pure refactor)

[ernestprovo23]

Summary

Part of DSE-1514 (bounded cost receipts) — Round 2 of 4: a pure refactor with zero behaviour change. The eval subsystem's pessimistic-ceiling pricing arithmetic moves into a shared product module so Council can price receipts (Round 3) and gate spend (Round 4) without importing conclave.evals.

• New src/conclave/pricing.py: PriceRates, ReservationAmounts, validate_token_bound, reserve_cost, reported_usage_cost — Decimal only (float rates rejected), ROUND_CEILING, quantized to USD_MICROCENT. Imports nothing from conclave.evals.
• evals/pricing.py: ModelPrice.as_rates(); reserve_call_cost delegates. ModelPrice / PriceBook / hash_price_entries / validate_price_book / load_price_book unchanged — their hash includes the eval schema_version and the frozen EXPECTED_PRICE_HASH test still passes.
• evals/live.py: _reported_usage_cost delegates.

Verification

• tests/evals/ untouched (git diff --stat -- tests/evals empty).
• Review verified numerical identity vs main over a 60-case grid (zero and large token bounds, many-digit rates, the unattributed-usage branch, the "total < attributed" error): every Decimal field byte-identical incl. exponent.
• Builder: 850 passed at the round boundary, 935 on the full branch; CI: pytest 3.11 / 3.12 / 3.13, ruff, pip-audit, gitleaks.
• Plan: docs/plans/2026-09-03-bounded-cost-receipts.md Tasks 1–3.

Not in this PR

Rounds 3 (snapshot, receipt ceilings, _price_manifest, cache identity) and 4 (max_output_tokens, plan_calls, --max-spend-usd, exit code 4) follow as separate PRs.

Release classification

release_control.py classify will be run on the final head; the same vocabulary rule that hit DSE-1512 (token, validation, provenance in changed lines) is expected to return security-specific — a human receipt is expected, not a defect. No credential, redaction, or secret-scan control is touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K1dHPjZ1bZcE2GnX3KMMSH

[ernestprovo23]

Review status (DSE-1514 Round 2 — pure refactor)

• Unit review: approved — reserve_call_cost / _reported_usage_cost outputs byte-identical to main over a 60-case grid (incl. Decimal exponent), tests/evals untouched, frozen EXPECTED_PRICE_HASH unchanged; the shared module imports nothing from conclave.evals.
• Round 5 CSO read-only review of the whole DSE-1514 branch: no existing security control changed; security-specific is the classifier's vocabulary rule. Round 5 QA adversarial review: base-vs-head byte-identity holds with no flags; its findings (C1/C2/I1, M1–M5) are all in Rounds 3–4 (feat: cost ceilings on receipts from a dated, vendor-cited price snapshot — DSE-1514 round 3 of 4 #65/feat: pre-flight spend gate (--max-spend-usd, exit 4) — DSE-1514 round 4 of 4 #66) — none in this diff.
• CI green (pytest 3.11/3.12/3.13, ruff, pip-audit, gitleaks). Classification: security-specific → owner receipt at the exact head SHA required for merge.

🤖 Generated with Claude Code