fix(mcp): harden purchase budget settle ordering and accounting #82

These are follow-ups from the independent review of #80 (the per-process purchase budget). None blocked the merge.

1. purchaseSpent checks ExistingCommitment before err. A provider result of {ExistingCommitment: true} together with a non-nil error would release the reservation, even though money may have been spent. No provider is known to return that today, but checking err first is strictly safer on a money path.
2. The budget ledger is float64: reserved += usd, then later -= usd. That can leave an ulp-scale residual and flip an exact-boundary case. An integer-cents ledger would remove this.
3. Test gaps: no test covers a panic inside PurchaseCommitment (the reservation stays held, which fails closed) or context cancellation with a budget set.
4. The manifest's budget_usd and max_commitment_usd have min: 1, while the server accepts any value above 0. Pick one rule.