feat: gate Firstrade PAPER admission

[Pigbibi]

Scope

• pins QPK to 9f7e7f8335e97f83f66677ad5e73254a1a421759
• adds a default-off PAPER admission guard for the dry-run route
• validates immutable command, risk receipt, platform, PAPER mode, and matching runtime release before preview

Safety

• failure returns a redacted 409 audit receipt before the strategy cycle
• no live triple-ack path, strategy configuration, deployment workflow, or scheduler changed

Verification

• targeted pytest, Ruff, py_compile, and lock validation passed