Your safety check is the outage: cost-aware backoff for governed tool calls

A governor that blocks bad tool calls can also block the task forever, and its own blocks never show up as tool failures. Three counters, one moving average, and a fault-injection test that reproduces the deadlock in ten minutes.