feat: add shared paper execution admission contract

[Pigbibi]

Summary

• add a broker-agnostic, pure PAPER risk admission receipt and verifier
• bind the receipt into immutable execution-command intent
• compose release, timing, command integrity, risk disposition, and reconciled exposure effects into a fail-closed admission decision
• export stable receipt/findings APIs without importing QRS, broker SDKs, or infrastructure

Validation

• ruff
• targeted pytest: 18 passed, 6 subtests

Safety scope: no deployment, broker integration, or change to existing live/observe defaults.