fix: distinguish Firstrade submissions from fills

[Pigbibi]

Why

A live Firstrade submit response acknowledges the order but does not prove a fill. The runtime currently treats it as action_done and persists a submitted terminal stage.

Change

• retain submitted orders for audit and cash controls
• expose broker_submission_done, pending_reconciliation, and pending order count
• persist PENDING_RECONCILIATION rather than a completed action
• keep previewed and explicitly filled outcomes distinct

Dependency

Merge PR 251 first; it restores the GCS create-only primitive used by the existing live claim.

Verification

• targeted execution-service, rebalance-service, and live-claim tests passed
• git diff whitespace check passed