An agent run keeps its tokens in and out, and its cost-ledger entry carries them #12270

The one open box left from #12112. The ledger ships (src/core/ledger.ts, appendRun on the finish path in src/core/runs.ts), but entryOf cannot write tokens_in/tokens_out because a run row does not keep them. Only context_tokens is kept. The runner already reports usage (see tokensIn/tokensOut in src/actions/spend.ts).

Done when:

• Finishing an agent run stores the tokens it read and wrote on the run row: a migration adds two columns, and old rows read as unknown, not 0.
• entryOf writes tokens_in and tokens_out when they are known and leaves them out when they are not. They are never 0 for unknown.
• test/ledger.test.ts: an agent run that finishes with usage writes both fields, and bun scripts/ledger-verify.ts still says ok. A check run's entry has neither field.

Files: src/core/runs.ts, src/core/ledger.ts, the runner's finish call, test/ledger.test.ts. Touch nothing in src/web/ or src/flow/. Risk: the finish path is hot. Storing usage must never throw into it.

Reviewed pull #12274 at its head: ticked Finishing an agent run stores the tokens it read and wrote on the run row: a migration adds two columns, and old rows read as unknown, not 0.; entryOf writes tokens_in and tokens_out when they are known and leaves them out when they are not. They are never 0 for unknown.; test/ledger.test.ts: an agent run that finishes with usage writes both fields, and bun scripts/ledger-verify.ts still says ok. A check run's entry has neither field..