Make budgeted GenPlan CLI runs reliable

[joshnroy]

Summary

• resume exact Claude CLI conversation continuations by session ID and send only the new user turn
• retain the plain-LLM isolation flags while resuming
• use one shared ten-hour GenPlan container limit for Docker and Apptainer
• remove named Docker containers when host launch times out or is interrupted
• retry explicitly uncharged Claude HTTP 5xx failures with bounded exponential backoff and jitter
• wait until the reported reset after explicitly uncharged session-limit 429 responses, then retry
• preserve immediate failure for ambiguous-cost responses and non-retryable errors

Why

These behaviors all belong to one runtime reliability boundary: a budgeted GenPlan conversation should survive transient service failures and subscription reset windows without duplicating potentially charged calls, losing conversation context, or outliving its host process.

The former one-hour Docker timeout could abandon a $20 run before held-out evaluation. The former completion path also surfaced transient 5xx and session-limit 429 responses as fatal errors even though the agentic path already knew how to wait for reset.

Verification

• 121 focused tests passed (2 paid integration tests deselected)
• changed-file mypy passed
• Black, isort, pylint, and diff checks passed
• added regression coverage for session continuation, isolation flags, timeout cleanup, uncharged 5xx retries, session-limit waits, and ambiguous-cost failures

Stack

Stacked on #172. This PR now includes the former #179 and #181.

[merlerm]

LGTM! Do you think some of these changes would also be good to include in our agentic backend? Also one thing to be careful of is to check if when there are two parallel runs going, each resumes to its own correct history instead of a different one. I had some issues with this at some point