fix: wire cached-only read-only broker reconciliation

[Pigbibi]

Purpose

Replace the absent production reconciliation client builder with the existing SDK in a cached-session-only account-read path.

Safety

• No password/MFA reads, login fallback, cache save/delete, quote or order requests.
• Fresh non-trading client; finite unexpired cache, explicit account required before connection.
• Instance-only GET allowlist, bounded timeout, redirects and ambient netrc/proxy disabled; stop on first HTTP/auth/JSON failure.
• Close client on success and failure; retain disabled/continuity/baseline and incomplete-executions guards.
• No runtime/config/Scheduler/provider operations. This does not establish complete reconciliation or live readiness.

Verification

• RED: 17 absent cached-only path/builder cases; an additional account-precondition regression reproduced independently.
• GREEN: 84 focused client/request/reconciliation tests.
• Full local suite before the final account precondition: 335 passed (one upstream calendar deprecation warning).
• Ruff and git diff --check passed. Required CI must pass before merge.
• Existing SDK source independently inspected read-only; no broker connection.