feat: add verify-only legacy recovery controller

[Pigbibi]

Summary

• add a private verify-only controller for confirmed IBKR legacy recovery
• recheck the full dual-review receipt, bounded QRS confirmation, fresh read-only reconciliation evidence, and deployed RECONCILE_ONLY runtime target
• consume QPK strict post-confirmation timing semantics

Safety

• returns a transition plan only; it never writes Cloud Run/runtime state, broker settings, execution markers, or orders
• uses a dedicated controller-read token and never follows redirects
• equal-second confirmation/evidence timestamps are now explicitly rejected

Validation

• python3 -m compileall -q scripts/verify_reconciliation_recovery.py tests/test_reconciliation_recovery_verify_only.py
• direct focused verification and fault-injection checks
• uv lock --check
• python3 scripts/check_qpk_pin_consistency.py

GitHub CI will run the complete suite.