feat: add Alpaca paper admission contract

[Pigbibi]

Summary

• add a local, fail-closed PAPER_DRY_RUN admission contract
• bind non-sensitive endpoint/config/strategy/deployment/risk digests to cycle and validity window
• reconcile identical cycle content and reject conflicting replays
• reject live/shadow, shadow receipt escalation, raw endpoint, account/order/credential fields

Scope

No Alpaca SDK, network, workflow, scheduler, credentials, or order execution changes.

Verification

• PYTHONPATH=src python3 -m pytest -q (53 passed)
• python3 -m ruff check .
• git diff --check