test: restore full CI suite with immutable dependencies

[Pigbibi]

Summary

• restore collection and execution of all five previously excluded pytest files
• remove mutable sibling-repository main resolution and undeclared editable installs from CI; uv sync --frozen is now the only dependency install path
• bind the offline QPK pin guard to the immutable QPK revision declared by pyproject.toml and uv.lock
• isolate request-routing tests from the separately tested execution-receipt adapter, and update two stale probe mocks to the current read-only call signature

Exact-base baseline and classification

Base: 6d4705639ef630f4474949caeec2ecfccd8fe169 (fresh origin/main; includes merged #455).

The requested historical 25 failures / 44 errors is no longer reproducible on this exact base because #455 already repaired the legacy suite and local test-package import shadowing. The unmodified full suite on this base produced:

• 11 failed, 492 passed, 5 skipped, 0 collection errors
• 9 failures: request tests did not isolate the newer execution-receipt contract, which has dedicated adapter coverage
• 2 failures: probe mocks did not accept the current read_only and validate_trading_permissions keyword arguments
• CI reproducibility gap: QPK/UES/UESP were resolved from mutable shared branches, while only QPK/UES/HKS are declared at immutable revisions in pyproject.toml/uv.lock
• no remaining failure required strategy, risk, broker, order, provider, replay, deployment, Scheduler, or QPK production-contract decisions

Validation

• uv sync --frozen --extra test
• full suite with isolated temp state: 505 passed, 5 skipped
• focused restored-suite and contract tests: 94 passed
• request handling plus execution-receipt adapter: 52 passed
• uv run --no-sync ruff check --exclude external .
• uv lock --check
• deterministic local QPK pin guard with QPK_EXPECTED_PIN=b13e28759a880dcb446dbfbc580dc032333b065e
• git diff --check
• git diff --exit-code -- pyproject.toml uv.lock qsl.toml
• actionlint -color .github/workflows/ci.yml
• full-repo actionlint -color still reports only two pre-existing ShellCheck warnings in untouched collect-reconciliation-evidence.yml and runtime-target-lifecycle.yml

Scope

No production runtime, trading, strategy/risk semantics, provider/replay, broker/order, deployment, Scheduler, QPK production contract, dependency declaration, or lockfile was changed. This PR is independent of #456 and does not modify, merge, or delete any existing branch.