fix: bound breach history + CostGuard thread safety (#253)

- RingBreachDetector: change _breach_history from unbounded list to
  deque(maxlen=10_000) with configurable max_breach_history (#247)
- CostGuard: add threading.Lock protecting _org_spent_month read-modify-
  write in check_task() and record_cost() (#246)

Closes #247, closes #246

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: imran-siddique

packages/agent-hypervisor/src/hypervisor/rings/breach_detector.py

@@ -84,6 +84,7 @@ def __init__(
         window_seconds: int = 60,
         baseline_rate: float = 10.0,
         max_events_per_agent: int = 1_000,
+        max_breach_history: int = 10_000,
     ) -> None:
         self.window_seconds = window_seconds
         self.baseline_rate = baseline_rate
@@ -93,8 +94,8 @@ def __init__(
         self._call_windows: dict[str, deque[float]] = {}
         # Per-agent circuit-breaker flag
         self._tripped: dict[str, bool] = {}
-        # Global breach history
-        self._breach_history: list[BreachEvent] = []
+        # Global breach history (bounded)
+        self._breach_history: deque[BreachEvent] = deque(maxlen=max_breach_history)
 
     # ------------------------------------------------------------------
     # Public API

packages/agent-sre/src/agent_sre/cost/guard.py

@@ -6,6 +6,7 @@
 from __future__ import annotations
 
 import math
+import threading
 import time
 from collections import deque
 from dataclasses import dataclass, field
@@ -146,6 +147,7 @@ def __init__(
         self._alerts: list[CostAlert] = []
         self._cost_history: deque[float] = deque(maxlen=1000)
         self._org_spent_month: float = 0.0
+        self._lock = threading.Lock()
 
     def get_budget(self, agent_id: str) -> AgentBudget:
         """Get or create budget for an agent."""
@@ -177,11 +179,12 @@ def check_task(self, agent_id: str, estimated_cost: float = 0.0) -> tuple[bool,
             return False, f"Would exceed daily budget (${budget.remaining_today_usd:.2f} remaining)"
 
         if self.org_monthly_budget > 0:
-            if self._org_spent_month + estimated_cost > self.org_monthly_budget:
-                return False, (
-                    f"Would exceed org monthly budget "
-                    f"(${self.org_remaining_month:.2f} remaining)"
-                )
+            with self._lock:
+                if self._org_spent_month + estimated_cost > self.org_monthly_budget:
+                    return False, (
+                        f"Would exceed org monthly budget "
+                        f"(${self.org_remaining_month:.2f} remaining)"
+                    )
 
         return True, "ok"
 
@@ -208,9 +211,10 @@ def record_cost(
         self._cost_history.append(cost_usd)
 
         # Update budget
-        budget.spent_today_usd += cost_usd
-        budget.task_count_today += 1
-        self._org_spent_month += cost_usd
+        with self._lock:
+            budget.spent_today_usd += cost_usd
+            budget.task_count_today += 1
+            self._org_spent_month += cost_usd
 
         # Per-task limit check
         if cost_usd > self.per_task_limit: