feat: enforce canonical IBKR order identity

[Pigbibi]

Summary

• define one account-scoped canonical IBKR order key aligned with pinned ib-insync==0.9.86: positive orderId uses account/client/order; non-positive manual orders use account/permId
• attach the key to submission and read-only reconciliation records
• fail closed with ReconciliationRequired / order_identity_unavailable when identity cannot be normalized, and prevent upstream execution summaries from reporting success
• document the identity state table and reconciliation digest compatibility boundary

This is a new slice from 6d4705639ef630f4474949caeec2ecfccd8fe169; no implementation code was reused from closed PR #454.

Scope boundaries

• no provider, replay, broker/order, deploy, Scheduler, or QPK execution
• no QPK, dependency, lockfile, workflow, or CI-exclude changes
• no partial/cancel outcome, funds/positions, retry, or strategy-semantics changes

Tests

• tests-first RED confirmed for missing helper/key, missing submission identity outcome, and a filled report being incorrectly marked executed
• 66 passed: focused reconciliation/submission/execution-service tests
• 430 passed, 5 skipped: repository practical CI test scope
• ruff check --exclude external .: passed
• uv lock --check: passed
• git diff --check: passed
• dependency/workflow diff guard: passed

An unfiltered local test run exposed 11 failures only in the repository's already-excluded tests/test_request_handling.py; the exact base commit reproduced the same 11 failures. This PR does not change those exclusions or unrelated fixtures.

Compatibility risk

• canonical keys now enter private open-order/recent-execution normalized records, so previously enrolled digests can mismatch and remain fail-closed in RECONCILE_ONLY
• accepted submissions without a complete account/client/order identity now return ReconciliationRequired instead of being treated as successful

[Pigbibi]

Closing unmerged under CC2: the frozen head dc577a0 was blocked by the independent semantic acceptance. Canonical identity can be absent while reconciliation reports executed, and mixed identity failure does not take fail-closed precedence. Per the frozen-head rule, no post-review patch is permitted on this PR. A successor, if approved, must address only these invariants with adversarial tests.