Take the cap reset time as an epoch from the agent, not parsed off its screen

[MJohnson459]

The capped badge read "resets 6:40pm" off a session's terminal capture and
resolved it to whichever occurrence was nearest, because a bare clock time
carries no date and is ambiguous by half a day either way. The same quantity is
available exactly, and this takes it: an optional cap agent verb prints when
the account's usage window reopens as a Unix epoch, and where a reading exists
it decides both the time on the badge and whether the window has reopened.

The blocking question, settled

It rested on whether the probe still emits the event when the account is
capped, and the answer is yes — established from the CLI's own code rather than
by waiting for a cap to land. On a 429, extractQuotaStatusFromError builds the
rate-limit info from the response's anthropic-ratelimit-unified-* headers with
status: "rejected" and resetsAt taken from unified-reset, calls
emitStatusChange, and the print-mode listener enqueues a rate_limit_event
onto the stream-json output. A usage cap is also non-retryable (settled by #453
at the same source), so that happens on the first refusal rather than after a
retry loop — the event lands promptly in exactly the case it is wanted.

Two things could not be established that way and are worth knowing: the in-binary
rate-limit simulator is dead code in shipped builds, so a cap cannot be faked
locally; and the CLI's own cheap quota check (max_tokens: 1, headers only) is
internal, with no claude usage subcommand exposing it. The probe measured at
$0.0177 and ~4s per call, mostly cache creation.

The shape

• cap agent verb (voro-core/src/agent.rs): opaque like logs, and the
  only verb that names nothing — a cap belongs to the account, not to any one
  conversation, so one reading answers for every session on the strip. Every
  placeholder is refused at config-validation time. Its negative answer is
  silence: print the instant while the account is refused, print nothing
  otherwise, so an uncapped account, a failed command and an agent defining none
  all land identically on the old parse. Built in for claude, absent for
  codex.
• CapWindow::resolve (voro-core/src/cap.rs): the one place the account's
  instant and the session's parsed clock time resolve into the single answer the
  badge and the nudge sweep both read, so the two cannot disagree about which
  source spoke. The instant wins where there is one. parse_reset_epoch reads
  the verb's output, refusing any number that is not a timestamp near the
  present.
• AccountCapProbe (voro/src/probe.rs): keyed by agent rather than by
  task, and the only runner whose debounce guards money rather than latency. It
  is asked only while a session is already badged capped, once per capped
  episode — once more only if the instant it named has since passed while the
  badge is still up — with a ten-minute floor as a backstop. A reading that came
  back empty is held too, which is what stops a session capped on a limit the
  probe does not hit from buying a call every interval.
• The badge renders identically; what changed is that "reset passed" is now a
  fact rather than a nearest-occurrence guess, and a cap whose wording named no
  time at all gets one. That last part closes the gap #437 would otherwise have
  to work around: the sweep's untimed-cap rule ("the operator's judgement stands
  in for the clock") retires one session at a time as the account times them.

One caveat is priced in DESIGN.md rather than guarded: an account is refused by
one window while a session may be held by another (a weekly model limit behind
a five-hour account cap), so the instant can be early for that session — which is
the failure §8 already prices as cheap, a nudge that re-caps at once.

Verification

cargo test --workspace — 900 pass (500 voro + 399 voro-core + 1 integration),
cargo clippy --workspace --all-targets -- -D warnings and cargo fmt --check
clean. New tests cover the epoch parse and its plausibility band, the precedence
both ways, the sweep's due rule, the probe's debounce including the held-empty
case, the verb through a real subprocess, and the config validation.

Driven end-to-end in the TUI against a scratch store, with a stub agent whose
logs verb says only "Weekly limit reached" — no time on screen at all — and
whose cap verb prints an instant. The row badged ⚠ capped ↻23:42, flipped to
⚠ capped · reset passed when the instant was behind the clock, and u released
the session (stop fired at ref-1), sent continue, and dropped the badge.
The real built-in template was also run through sh exactly as Voro renders it:
it prints nothing while the account has room, which is the uncapped answer.

Note for merge

Task #453 is in flight on cap-retry-reading-453 and touches the same three
functions (CapReading, reset_passed, the badge and the sweep) to add
retrying. The two are additive to each other but will conflict textually —
land #453 first and rebase this on it; the retry flag belongs inside
CapWindow::resolve alongside the precedence rule once both exist.