Harden evidence-grade risk assessment gate

[Pigbibi]

Summary

• Require mandate provenance and matching candidate identity for evidence-grade approvals.
• Fail closed on missing or invalid evidence authority.
• Document RiskEngine.assess as a legacy, non-evidence-grade runtime sanity check.

Tests

• PYTHONPATH=src python3 -m pytest -q — 1341 passed, 1 skipped, 26 warnings, 392 subtests passed.
• python3 -m ruff check src/quant_platform_kit/risk/engine.py src/quant_platform_kit/risk/gate.py tests/test_risk_gate.py — passed.
• python3 -m compileall -q src tests — passed.
• git diff --check — passed.
• Sensitive-information scan of added diff lines — passed.

Scope

• 3 files only:
  • src/quant_platform_kit/risk/engine.py
  • src/quant_platform_kit/risk/gate.py
  • tests/test_risk_gate.py
• No runtime execution, provider calls, or deployment.