fix: reconcile stable position quantities instead of valuations

[Pigbibi]

Summary

• Hash the existing SDK items surface as sorted normalized symbol / exact quantity facts, instead of changing price, valuation or profit/loss fields.
• Normalize symbol whitespace/case and numeric spelling without decimal-context rounding. Keep unmanaged holdings; reject missing/malformed quantities, duplicate normalized symbols, booleans and NaN/inf. Preserve the raw in-memory observations.
• Apply the same validation at collection and candidate construction. Do not modify cash, order-history completeness, expected-reference handling, runtime, dependencies or workflows.

Compatibility / safety

This changes the meaning of positions_sha256 from a raw-payload digest to a stable accounting projection. Existing raw-payload baseline digests are NOT directly comparable and are NOT automatically overwritten or reinterpreted. Any replacement reference must be independently verified under existing authorization, never copied from the current observation to self-certify a match.

This patch does NOT solve the Firstrade fill-history gap. recent_executions_available remains false and candidates remain blocked. No claim of broker/account recovery, no order/provider/cloud/login/refresh operation, and no deploy/config mutation.

Verification

• Fresh base 4a32dc4.
• Existing retained patch tests against baseline implementation loaded in memory: 45 failed / 14 passed.
• Symbol spelling regression before normalization: 2 failed.
• Final focused tests: tests/test_broker_reconciliation.py, tests/test_request_handling.py, tests/test_runtime_config_support.py: 131 passed.
• Local pytest used cleared environment, deny-network sandbox and process-only QPK cloud-loader stubs where relevant. All inputs are synthetic.
• ruff check application/broker_reconciliation.py tests/test_broker_reconciliation.py and git diff --check passed.
• Current pinned shared packages confirmed; no dependency changes.

Scope

Exactly application/broker_reconciliation.py and tests/test_broker_reconciliation.py. Deploy Cloud Run is workflow_dispatch-only; PR/main CI does not deploy. Other PRs, baseline references and runtime configuration remain untouched.