Add bounded Earn accounting diagnosis

[Pigbibi]

Problem

The forward Earn accounting consumer can fail closed on earn_quantity_change_unexplained, while the existing migration and recovery diagnostics use legacy or approved rebase baselines and cannot explain the current checkpoint window.

Change

• add accounting_migration_action=earn-forward-diagnose behind the existing disabled main and reconcile_only workflow gates
• read the current ledger checkpoint, Spot/Flexible Earn, bounded myTrades, the existing cash-flow cursor, and bounded reward history using existing read-only clients
• classify per-asset direction, product/counter status, BONUS counts and residual match, bounded trade/net and external-flow flags, while retaining causal_reconciliation=false and execution_authority_granted=false
• allow an existing owner to be observed; compare owner, ledger, and control snapshots before/after and discard on any change
• keep old _read_source, audit, migration writes, owner handling, and accounting behavior unchanged

Validation

• python3 -m pytest -q tests/test_earn_forward_diagnosis.py tests/test_daily_accounting_migration.py tests/test_runtime_workflow_security.py tests/test_earn_accrual_checkpoint.py tests/test_forward_earn_accounting.py tests/test_balance_diagnostics.py tests/test_balance_flow_diagnostics.py
• 250 passed
• python3 -m py_compile scripts/migrate_daily_accounting_state.py
• git diff --check

No workflow was dispatched and no production/accounting/owner write was performed.