feat: publish redacted IBKR recovery source

[Pigbibi]

Summary

• add an opt-in IBKR recovery-source publisher for the QRS reconciliation queue
• accept only a QPK-ready candidate and bound AIAuditBridge mandatory dual-review receipt
• emit/publish only redacted, non-executable source snapshots; default is no network call
• advance QuantPlatformKit pin to the recovery-contract commit

Safety

• no IBKR connection, runtime-target mutation, execution marker write, or order path
• source publication only targets the dedicated HTTPS recovery ingress and does not follow redirects
• later controller re-verification and an operator confirmation remain mandatory

Validation

• python3 -m compileall -q scripts/publish_reconciliation_recovery_source.py tests/test_reconciliation_recovery_source_publisher.py
• direct focused safety scenarios with local QPK source
• python3 scripts/check_qpk_pin_consistency.py
• uv lock --check

Local pytest is not installed on the VPS; GitHub CI runs the full suite.