feat: gate IBKR PAPER admission

[Pigbibi]

Scope

• pins QPK to 9f7e7f8335e97f83f66677ad5e73254a1a421759
• adds a default-off PAPER-only pre-submit admission boundary for ordinary IBKR PAPER execution
• requires immutable command, embedded risk receipt, matching release, and reconciled exposure effect before submit

Safety

• leaves IBKR_PAPER_LIQUIDATE_ONLY unchanged
• no live path, strategy settings, deployment workflow, invocation workflow, or scheduler changed

Verification

• 76 targeted tests, Ruff, lock validation, and QPK pin consistency passed