feat: add isolated paper command consumer [skip-cloud-run-deploy]

[Pigbibi]

Summary

• add a read-only, paper-only durable command consumer with per-symbol position reconciliation and runtime gate evidence
• bind paper commands to a complete strategy release identity and refuse unsafe or un-attested consumption
• add a manual paper-command-verify Cloud Run workflow target with a distinct service, no scheduler, and a separate command-storage URI requirement

Safety

• no broker execution port is built by the consumer
• no token refresh or secret mutation occurs in the read-only consumer path
• this PR includes [skip-cloud-run-deploy]; it does not deploy or modify SG or existing PAPER services

Verification

• targeted pytest: 95 passed
• targeted ruff: passed
• Cloud Run workflow contract check: passed