menubar: linear pace on Codex quota windows — deficit/reserve, projection, run-out ETA

[avs-io]

Phase 1 of #726 (Part 2 of epic #725), as green-lit in the issue thread.

What changed

Codex Plan-tab quota windows stop passing projection: nil and get a pace caption under the bar, via the existing WindowProjection/ProjectionCaption plumbing:

• QuotaPace (new, pure): whole-window linear pace from (usedPercent, resetsAt, limitWindowSeconds, now). Produces deltaPercent (used − expected; deficit/reserve), the linear projectedPercent at reset, and — only when the projection overflows and the window is longer than 6h — a hitsLimitAt ETA.
• Noise guards, per the issue: nothing until ≥3% of the window has elapsed; nothing on reset-time skew (reset in the past, or further out than one window length); nothing on an exhausted window (the bar already says it); inputs clamped.
• 5-hour windows never get a run-out ETA (per the review note on menubar: quota windows show no pace — add run-out projection (deficit, lasts-to-reset / runs-out-in) #726): linear extrapolation on a short bursty window cries wolf. They render deficit/reserve only ("40% in deficit"), via a compact caption mode.
• Caption wording: "On pace: 92% at reset" (|Δ| ≤ 2), "12% in deficit · hits 100% in 2 days", "8% in reserve · 74% at reset". Estimate-flavored, matching the existing Claude captions' style.
• Claude windows are untouched: WindowProjection grows two defaulted fields (deltaPercent, compact) and the existing caption path is byte-for-byte the same when they're absent.

How tested

• swift build clean via local swift.org 6.3.3 toolchain.
• New QuotaPaceTests (8 tests): on-pace midpoint, deficit-overflow ETA landing at exactly 4.375d elapsed and strictly before the reset, reserve, 5h-window ETA suppression with deficit retained, early-window silence, all skew guards, exhausted/over-100 silence, zero-usage reserve.
• XCTest cannot run on this machine (no Xcode; known limitation covering the whole existing mac/Tests suite), so CI is the XCTest gate. The identical 13 assertions were run through a standalone script under the same toolchain: 13/13 pass.

Phase 2 (historical forecast + risk %) stays out of this PR per the issue's phasing; the evidence-gate validation requirement from the epic is noted for when it starts.