fix(execution): require durable claim before live submission

[Pigbibi]

Summary

• Require enabled strategy-run persistence and a durable state store at the actual non-dry-run submission boundary.
• Reject missing submission-claim callbacks for sell, whole-share buy and notional buy; retain legitimate no-op and dry-run preview behavior.
• Retain permanent claims after ambiguous submission or completed-state persistence failure.
• Correct the existing CI source-selection defect: checkout QPK/UES at uv.lock revisions, retain frozen installed packages instead of editable overrides, and run the existing QPK checker against the locked expected pin. Dependency pins and lockfile are unchanged.

Validation

• Business regression RED: 6 expected failures / 55 passes; GREEN: 61 passes. Expanded synthetic coverage: 110 passes.
• CI regression RED: 3 expected failures / 3 passes; combined focused GREEN: 68 passes.
• Fresh temporary runtime installed 53 packages offline from existing cache with uv sync --frozen --extra test. uv pip check passed; installed shared direct_url identities and import smoke match exact lock revisions. Existing QPK pin checker and uv lock --offline --check passed.
• Full local suite under a strict socket/subprocess prohibition: 292 passed; 4 existing subprocess-based env-sync-plan CLI tests were blocked by that local safety hook, not by application failures. Remote CI runs those unchanged synthetic CLI tests normally.
• Full-repository Ruff and git diff --check passed. Six-file scope only; the original four business files were unchanged by the CI correction.

Boundaries

No broker/provider/runtime/deployment operations. Only pull-request/main-push offline CI is triggered; deploy/invoke workflows remain explicit-dispatch only. This does not establish physical-account cross-platform fencing or verify the deployed state store.