feat(status): surface rail-17 attestation expiry before it vetoes, and a rules enable verb (#340)

[eaitbrahim]

Closes #340

What & why

On 2026-08-14 rail 17 vetoed the only live DCA signal because the withdrawal-capability
attestation had expired; as of 2026-08-17 both deployments' attestations were weeks stale, so
rail 17 was halting entries everywhere — and nothing surfaced that until the veto fired. This
PR makes the staleness VISIBLE before it vetoes, records the weekly refresh habit beside the
other account-level obligations, and closes the re-enable gap #339 depends on. The typed
re-attestation stays a human terminal action BY DESIGN — this is visibility and cadence, never
automation.

• keel status rail-17 line (also rendered by keel tui, styled alert on every halted
  state): a new WithdrawalAttestationStatus on the existing StatusReport, resolved through
  the executor's own _withdrawals_enabled and aged with the executor's own
  WITHDRAWAL_ATTESTATION_TTL_SEC — never a restated 7 days — so the display cannot call an
  attestation fresh on the very cycle the rail vetoes it:
  • rail 17 (withdrawal capability): attested, expires in 3d
  • rail 17 (withdrawal capability): EXPIRED 12d ago -- entries halted; re-attest with keel withdrawals attest
  • rail 17 (withdrawal capability): never attested -- entries halted; re-attest with keel withdrawals attest
  • (plus the fresh-deliberate case) ... SUSPENDED -- entries halted; re-attest with keel withdrawals attest --enabled
• Runbook cadence note (docs/operator-runbook.md, item 3 beside the USDC-rewards note):
  the weekly re-attestation habit, naming the consequence of missing it (rail 17 fails closed
  on unknown → live DCA buys vetoed, the 2026-08-14 event) and why the typed confirmation must
  stay human — a scheduled job must never release a §65.4 halt.
• keel rules enable <rule_id>: the inverse of rules disable's WRITE. Verified that
  disable records nothing about prior status (it stamps only demoted_at), so enable
  restores to candidate — the bottom of the ladder — and prints the path onward
  (rules promote, gated; --force as the documented bypass for paper-forwards that can
  never reach the min_trades floor, e.g. DCA). The docstring documents that a rule disabled
  from live lands at candidate, not live. This is the supported CLI path Re-measure under the honest cost model: simulate re-run, DCA dip ablation, paper DCA re-enabled #339's
  "re-enable the disabled paper DCA twins" needs.

Tests-first evidence

• Tests written first, seen failing for the right reason

Red run (all 11 new/extended assertions failing on the pre-change code, none for an import
error — the rail-17 gather tests fail on the missing withdrawal_attestation field, the
render/CLI tests on the missing line, the enable tests on No such command 'enable'):

FAILED tests/commands/test_status.py::test_rail17_attested_fresh_shows_time_remaining
FAILED tests/commands/test_status.py::test_rail17_expired_names_the_halt_and_the_fix
FAILED tests/commands/test_status.py::test_rail17_never_attested_is_said_as_such
FAILED tests/commands/test_status.py::test_rail17_suspended_attestation_still_names_the_halt
FAILED tests/commands/test_status.py::test_rail17_freshness_uses_the_executors_own_ttl
FAILED tests/commands/test_status.py::test_rail17_line_sits_beside_rail11
FAILED tests/commands/test_status.py::test_status_command_runs_read_only_and_prints_key_facts
FAILED tests/commands/test_status.py::test_status_command_json_flag_emits_parseable_json
FAILED tests/test_cli.py::test_rules_enable_restores_a_disabled_rule_to_candidate
FAILED tests/test_cli.py::test_rules_enable_on_a_non_disabled_rule_is_an_error
FAILED tests/test_cli.py::test_rules_disable_then_enable_round_trip_lands_at_candidate
9 failed, 2 passed, 95 deselected

The TUI rail-17 styling tests were likewise seen red (5 failed) before the TUI line was
added.

Gates (all must pass)

• uv run ruff check clean — All checks passed!
• uv run mypy clean — Success: no issues found in 238 source files
• uv run pytest -q green — 2945 passed, 1 skipped in 35.38s

Scope check

• This PR touches a rail or a default classification — checked means it DOES;
  leave checked only if true, and if so: cite the source and open the discussion
  BEFORE review (CONTRIBUTING.md, "Governance: rulings vs. machinery").
• New dependency added (needs discussion first)

No rail, guard, or classification changes: rail 17's veto logic is untouched; this PR only
reads the same state through the executor's own resolver. Stale comments claiming disabled
is terminal were updated (rules.py disable docstring, promotion.py _PROMOTE_NEXT note)
to name the new operator verb.