Fix RF-index guard, common-end panel trim, notebook contamination fal…

[diluteassets]

…se-positive, and error-swallowing in _download

• metrics.annualized_sharpe now raises on a misaligned rf Series index instead of silently auto-aligning and dropping months (matches factor_regression and the paired bootstrap's existing guard).
• data.build_panel now trims to a common END across tickers, not just a common start, so mixed-age caches can't produce NaN tails.
• 04_results.ipynb's OOS-contamination assert matched prior confirmatory rows on end_date, which advances every time LAST_COMPLETE_MONTH_END is bumped -- false-positiving on every future rerun. Now matches on the full-history start date (fixed) plus signal config instead.
• data._download no longer swallows the real exception from a failed TLS profile; the last one is chained via raise ... from last_exc.
• Documented (not changed): the final holding period's exit is never costed, symmetric with the buy-and-hold benchmark's own uncosted final mark.
• README/ROADMAP wording: "the edge survives 20 bps" corrected to describe the net Sharpe's sign, not a claim of edge (contradicted Phase 5's zero-alpha verdict); block-bootstrap length description corrected to match metrics.py's actual pre-registered-then-checked story.
• Added CI (pytest + ruff) via .github/workflows/ci.yml with a README badge, made the project pip-installable (pyproject.toml build-system), and split requirements.txt into runtime vs. requirements-dev.txt tooling.
• Disclosed in the README: trials_log.csv shows the same in-sample config's Sharpe drifting in the 6th digit across pulls because Yahoo restates historical adjusted prices on new dividends.

Claude-Session: https://claude.ai/code/session_01QBmZ3Uk5PETpZqh53aWJvE