fix: interactive Realm password, recoverable worker budget (0.9.15)

Prompt for Realm password when CST_REALM_PASSWORD is unset; map worker
request-gate exhaustion to a clear budget error with partial progress;
hard-skip identical tool failures after 3 tries. Add docs/parliament.md.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/subagent.c

@@ -1087,10 +1087,20 @@ static int task_run(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c,
   }
   long tokens = cst_agent_last_prompt_tokens(run.child);
   cst_buf_t b = {0};
-  if (rc != 0)
-    cst_buf_printf(&b, "error: sub-agent %s: %s\n", cancelled ? "cancelled"
-                                                              : "failed",
-                   err[0] ? err : "unknown error");
+  if (rc != 0) {
+    int budget = err[0] && (strstr(err, "budget:") ||
+                            strstr(err, "budget exhausted"));
+    if (budget) {
+      cst_buf_puts(&b, "error: worker request budget exhausted\n");
+      if (err[0])
+        cst_buf_printf(&b, "detail: %s\n", err);
+      cst_buf_puts(&b, "hint: raise .agent/workers.json max_requests, or "
+                       "finish the remaining work yourself with local tools.\n");
+    } else
+      cst_buf_printf(&b, "error: sub-agent %s: %s\n",
+                     cancelled ? "cancelled" : "failed",
+                     err[0] ? err : "unknown error");
+  }
   if (final) {
     while (*final == ' ' || *final == '\n')
       final++;