feat: harden forward observation lifecycle evidence

[Pigbibi]

Scope

Strengthens the generic no-order forward-observation contract. No broker, runtime target, deployment, strategy parameter, or Live behavior is added.

Changes

• require every frozen candidate to explicitly declare calendar, fixed/rolling window, start, rationale, and exact Shadow/Paper evidence modes
• complete windows now stop non-Live observation and enter human review; they never emit continue actions
• make risk blocks, manual holds, identity mismatch, revocation and supersession non-auto-resumable
• add immutable receipt v1 with candidate/policy binding, digest chain and frozen P2/P3/risk/release/plugin dependency checks

Safety

• all controller decisions remain no_order=true and live_authority_granted=false
• only temporary data or mode-health failures can auto-resume
• receipts contain only hashes, dates, logical IDs and modes; no prices, accounts, orders or secrets

Validation

• PYTHONPATH=src uv run --with pytest==9.1.1 python -m pytest -q tests/test_forward_observation.py tests/test_forward_observation_receipt.py (18 passed)
• uv run --with ruff==0.14.14 ruff check ...
• git diff --check