Two bugs in the bootstrap budget cap introduced in Martian-Engineering#255:

1. A single oversized tail message bypasses the budget entirely.
   The trim loop condition 'if (kept.length > 0 && ...)' means the
   first message (newest) is always kept regardless of size. A 50K-token
   tool result as the last message will bypass a 6K budget. Fix: after
   the loop, check if the single kept message exceeds budget and return
   empty instead of silently bypassing.

2. NaN propagates through all numeric env config parsing.
   parseInt('oops', 10) returns NaN, which is not nullish, so
   ?? fallback never fires. Invalid env like LCM_LEAF_CHUNK_TOKENS=oops
   propagates NaN through leafChunkTokens, bootstrapMaxTokens, and every
   derived config value — effectively disabling all token budgets.

   Fix: add parseFiniteInt/parseFiniteNumber helpers that return undefined
   for non-finite results. Replace all 16 raw parseInt/parseFloat calls
   in resolveLcmConfig() with the safe helpers.

Both bugs were found and reproduced with minimal scripts during
adversarial review of a production incident.

#258)

* fix: harden bootstrap budget against oversized messages and NaN config

Two bugs in the bootstrap budget cap introduced in #255:

1. A single oversized tail message bypasses the budget entirely.
   The trim loop condition 'if (kept.length > 0 && ...)' means the
   first message (newest) is always kept regardless of size. A 50K-token
   tool result as the last message will bypass a 6K budget. Fix: after
   the loop, check if the single kept message exceeds budget and return
   empty instead of silently bypassing.

2. NaN propagates through all numeric env config parsing.
   parseInt('oops', 10) returns NaN, which is not nullish, so
   ?? fallback never fires. Invalid env like LCM_LEAF_CHUNK_TOKENS=oops
   propagates NaN through leafChunkTokens, bootstrapMaxTokens, and every
   derived config value — effectively disabling all token budgets.

   Fix: add parseFiniteInt/parseFiniteNumber helpers that return undefined
   for non-finite results. Replace all 16 raw parseInt/parseFloat calls
   in resolveLcmConfig() with the safe helpers.

Both bugs were found and reproduced with minimal scripts during
adversarial review of a production incident.

* test: cover bootstrap and env fallback regressions

Add focused regression tests for the oversized singleton bootstrap tail case and invalid numeric env parsing fallback behavior. Add a patch changeset because this PR changes runtime behavior and should be reflected in release notes.

Regeneration-Prompt: |
  The open PR fixed two production regressions but still lacked the release and test follow-through needed to merge. Add targeted regression coverage instead of broad refactors: one config test that proves invalid numeric env values like LCM_LEAF_CHUNK_TOKENS=oops fall back through plugin/default resolution, and one bootstrap test that proves a single oversized tail message is dropped instead of bypassing bootstrapMaxTokens. Also add a patch changeset because the PR changes runtime behavior visible to users and maintainers expect release notes coverage for that.

---------

Co-authored-by: Eva <eva@100yen.org>
Co-authored-by: Josh Lehman <josh@martian.engineering>