Judge the sweep's cap readiness per agent account, and read a dated reset as a date

[MJohnson459]

The nudge sweep asked each badged session's own CapReading whether its reset
had gone by, and that rebuilds a fact that is not per-session. A usage cap
belongs to the account a session was launched under: every session on it reports
the same window, and the only way two of them can differ is that one is stale,
still displaying the window it was capped in hours ago. Judged alone that fossil
reads ready — correctly, its window did reopen — and since #428 nudging it stops
a live session to spend a turn the account re-caps at once. Separately, a weekly
cap read as ready days early: its reset carries a date (resets Aug 17, 9pm),
only the clock half was read, and resolved to the nearest occurrence it flipped
to ⚠ capped · reset passed the moment tonight's 9pm went by.

What changed.

• voro-core/src/cap.rs: CapReading gains reset_date, parsed from the mon d immediately before the clock in the same post-signature window that already
  fed the clock parse. reset_passed is now defined in terms of a signed
  minutes_until, so the sweep can rank two live readings; where reading and
  clock both carry a date the date decides, compared nearest-occurrence on a
  synthetic ordinal of twelve 31-day months. Only the sign of that difference is
  ever read, so short months and leap years do not enter into it and no calendar
  dependency is needed. LocalNow carries the clock and today's date together.
• plan_sweep (new, voro-core): takes the badged readings as (task, agent, reading) plus now, returns the task ids to nudge in ascending order and one
  CapHold per held agent. One live reading holds its whole group, untimed
  siblings included; a group with no live reading is swept entire, so a lone
  untimed cap is still the operator's call. The hold is labelled with the
  furthest-out live reset — the binding one. Grouping by agent entry is Voro's
  proxy for the account and errs conservatively on purpose: two entries sharing
  an account are not pooled (no worse than judging each session alone), while one
  entry across two accounts costs a delay rather than a stopped session.
• voro/src/app.rs: nudge_capped pairs each cap with its agent via
  last_sessions (a task whose session has vanished names no agent and is
  skipped), calls plan_sweep, and nudges through the unchanged nudge_one. The
  status line stops counting sessions before their reset and names the hold:
  claude capped until Aug 17 21:00 — 3 sessions, or nudged 2 capped sessions — codex capped until 21:50 (1 session) when mixed. App::now_minutes becomes
  App::now: Option<LocalNow>.
• voro/src/session_probe.rs: local_minutes becomes local_now, one
  subprocess returning clock and date (date '+%H:%M %m-%d') so a reading taken
  a second before midnight cannot pair yesterday's date with today's clock.
• voro/src/ui.rs: the badge keeps its three shapes and still shows a clock and
  never a date; it inherits the corrected verdict, so ⚠ capped · reset passed
  stops appearing days early.
• docs/DESIGN.md §8 records account-scoped readiness, the agent-entry proxy and
  both directions it can be wrong in, that the model is read off Claude Code and
  other agents may cap differently, the dated comparison behind a clock-only
  badge, and the untimed-sibling rule. CHANGELOG.md amended under unreleased.

How it was verified. cargo test --workspace (892 pass), cargo clippy --workspace --all-targets -- -D warnings and cargo fmt --all --check all
clean. New cap.rs tests cover the dated parse, a reset three days out at every
hour of today, a date two days behind, both directions across the year boundary,
a date with no clock and a date-shaped fragment with no signature; every existing
undated case keeps its answer. New plan tests cover a fossil beside a live
sibling of the same agent, the same two under different agents, an untimed
reading alone and beside a live sibling of the same and of a different agent, the
furthest-out label, an unknown clock, and ready-id ordering. The five existing
u tests stay green in substance (only the held case's status string changed),
joined by one for a weekly cap dated three days out and one for two same-agent
sessions where a single text is fresh — both driving the real key handler against
a scratch store with real stub agent verbs. The badge test draws the real cockpit
and asserts a dated future reset badges ⚠ capped ↻21:00 with no date and no
"reset passed".

Not verified through a live TUI drive: the verify skill isolates config with
XDG_CONFIG_HOME, which this session's worktree guard refuses, and voro has no
config flag to isolate it another way. The paths that would have shown are
covered by the tests above, which run the real subprocess verbs.

One thing to sequence. #441 (in review, cap-epoch-441) also makes the cap
reading account-scoped, from the other end — an exact instant from a cap verb,
resolved in CapWindow::resolve. The two do not conflict in substance but do in
cap.rs and nudge_capped, and the seam holds a real decision (should
plan_sweep take the account instant as a group-level input; which speaks when
an account instant and a further-out screen reading disagree). Filed as task #460
rather than decided here.