C6: safety & polish pass — typed-confirmation adversarial review, keybinds, runbook TUI section

[eaitbrahim]

Per the PRD §5 C6: keybinding/help consistency across the console; a dedicated adversarial review of the typed-confirmation contract and live-profile guards (can ANY key sequence bypass a typed prompt? can the live profile be selected implicitly?); an architectural pin that the TUI module contains no sizing/screening/gating/reporting math (imports services only, if testable); the runbook's TUI section updated to the console model. Acceptance: review round clean; the pin test merged; docs current.

[eaitbrahim]

C6 complete — merged in PR #408 (adversarially reviewed: approve after fixes — the verdict view now DELEGATES its backtest half to the rules service (resolve_rule_backtest/backtest_resolved extracted, CLI byte-identical), deleting the console-side assembly duplicate and SHRINKING the thinness allowance; the runbook + ceremony table now state exactly which typed prompts are the CLI's own (six) and which two the console adds stricter-than-CLI; the Ctrl-C sentence matches the mechanics; the suspend-check's runners are AST-derived — and the derivation immediately caught that the hand list had missed 3 of 14).

Delivered: the Account menu (pnl with its honest empty state, versions via one shared renderer — CLI byte-identical); the architectural thinness pin (four AST rules over the whole console layer — imports, call sites with per-site allowances, Decimal-display-only, broker construction seams — proven false on constructed violations); the ceremony audit as a table-driven suite with COVERAGE TEETH (every mutating console action classified typed/confirm/armed/ungated-by-design with refusal proofs; new registry mutations without a row FAIL the suite); and the runbook's 'The TUI console' section. Gates: 3651 passed, 3 skipped; ruff/mypy clean.