fix: fail closed on unavailable IBKR order identity

[Pigbibi]

Summary

• succeed closed PR feat: enforce canonical IBKR order identity #456 without modifying its frozen head
• require a canonical account-scoped order_key for every filled, partially filled, or pending broker result; broker_order_id alone is not identity
• make any order_identity_unavailable / ReconciliationRequired result take fail-closed precedence over completed or pending orders in the aggregate
• retain the bounded canonical identity contract for submission and read-only reconciliation, with a short compatibility note

Tests-first evidence

• latest origin/main@ccc219b0e8141d7fe27c8225e5bf12b95bda03e3: both adversarial tests RED because the aggregate returned executed
• frozen PR feat: enforce canonical IBKR order identity #456 head dc577a03b28a772b62b56259032a409be42baa29: the same two tests RED for the same reason
• successor GREEN: the two adversarial tests passed
• focused frozen baseline: 67 passed
• full frozen baseline: 519 passed, 5 skipped (5 existing deprecation warnings)
• local CI-equivalent gates: dependency sync, smoke imports, startup validation, ruff, QPK pin consistency, lock check, and diff check passed

Scope boundaries

• only execution aggregation, canonical identity normalization/propagation, related existing tests, and the reconciliation contract document
• no provider, replay, broker/order execution, deploy, Scheduler, paper, or live action
• no dependency, lockfile, workflow, configuration, or policy/rule changes

Risk

• canonical keys enter normalized open-order and recent-execution records, so legacy expected digests may mismatch and remain fail-closed in RECONCILE_ONLY
• accepted broker reports without a canonical key now block the aggregate even when another order completed; this is intentional

Head is frozen at 91d4a8779a85a5a761c3cbeb17340b31c01d0e95. Do not merge pending independent CC2 semantic acceptance.

[Pigbibi]

Closing unmerged under CC2. The frozen head 91d4a87 was BLOCKED by the one allowed independent semantic acceptance: a ReconciliationRequired receipt with a non-standard non-empty outcome can still be masked by a Filled result and summarized as executed. This is the one permitted successor for this invariant, so no further patch PR will be opened automatically; the invariant is PARKED for human redesign. No deployment or broker/runtime action was performed.

[Pigbibi]

Governance clarification: this closed PR is now classified as DESIGN_REVIEW_REQUIRED, not a permanent stop. The discovered mixed-outcome counterexample remains the source of truth. No third patch PR may be opened automatically. A new redesign PR is allowed only after an Owner explicitly approves a revised state-machine contract, root-cause statement, adversarial counterexample matrix, and minimal write scope. No runtime, broker, or deployment action is authorized by this clarification.