feat(tui): the console completed — account menu, ceremony audit, thinness pin, runbook (#392 C6)

[eaitbrahim]

C6, the final slice of the TUI-operator-console phase (PRD §5 C6, §6.2, O2/O3/O4). Four deliverables:

1. The Account menu — the last placeholder (keel/commands/account_console.py)

• pnl — the EXACT keel pnl report through the C1 services (commands.pnl.build_pnl_report + render_pnl_report) over the active deployment's imported transactions; when nothing is imported it renders its honest empty state naming keel db import, never a confident total realized P&L: 0.
• versions — the same lines keel versions prints, through ONE shared renderer extracted to keel/commands/versions.render_versions_lines (CLI output byte-identical, existing tests unchanged); disagreement renders loud where the CLI exits non-zero; the environment scan runs ONCE per entry, rows held (the venues browser's contract).
• The whole branch is READ-ONLY — no write path at all — and keeps the console contracts: banner-aware, m-close, cursor reset on entry, ? contextual help (three new modes registered in help_console).

2. The architectural thinness pin (tests/commands/test_console_thinness.py, PRD §6.2)

An AST scan over console.py + tui.py + every *console*.py with four rules:

1. No compute-tree imports — nothing from keel.strategy.*, keel.execution.{guards,sizing,executor}, keel.compliance.{screen,purification}, keel.analysis.* except constants/types (verified against the source module's own AST — the gate-wording/screen-vocabulary imports) and the audited function imports.
2. No compute-tree calls — any call resolving into those trees must match a (module, enclosing function, callee) allowance, each justified inline (the ledger's insights-mirrored paper-gate read; the Enter-gated verdict dispatching to the engine's own backtest+gate; the retry's next_status wording; the shared purification renderer; the executor's two READ helpers). Allowances are site-scoped and asserted to name real callees, so they cannot leak.
3. Decimal is display-only — no arithmetic operator over a Decimal(...) construction.
4. No broker construction outside the seams — only inside the build_broker/build_client lambda handed to a service (the run_fn seam) or the audited bounded read sites.

Proven false during development on deliberate scratch violations of every rule (sizing/guards/screen calls, Decimal math, a stray _build_broker) — each failed the pin by name — then removed.

3. The typed-confirmation + live-guard adversarial audit, as tests (tests/commands/test_console_ceremony.py)

Every state-mutating console action has a row: its ceremony class — typed-phrase (attest ×2 incl. the scout step, withdrawals --enabled, promote --force, autonomy ON, record-flow, reset-hwm, resume, resume-entries, the dashboard's a), confirm-step (the LIVE profile switch, retry's promote y/N), armed-enter (agent cycle, monitor, fetch/check/repair, simulate), ungated-by-design (kill's one-key contract, autonomy off, withdrawals suspend, rules add→candidate, enable/disable/demote, the ungated compliance forms, db import, paper switches, the f key) — and a refusal proof: existing tests referenced by name (asserted to exist), plus one compact generic all-empty-prompts proof (cancellation line AND byte-identical state) for the rows nothing covered. Cross-cutting: .rebind is called only from switch_profile (no key path around the LIVE confirm; CLI flags remain the documented direct binding), the sole order-capable dispatch is agent.run_once with the CLI's confirm gate, and every terminal-prompting run rides the one _run_terminal_form suspend/restore seam.

The teeth: the mutating keys are DERIVED from the dispatch registries (everything not declared read-only per module) — a newly added mutating entry fails the suite until classified (proven with a scratch fake TRADING_MENU entry), and a stale row fails the same equality.

4. The runbook's console section (docs/operator-runbook.md)

"## The TUI console", between the equities profile and "How much money moves", pinned by tests/test_runbook_console.py: what the console is (the menu tree over the C1 services, thin by construction), profile switching + the live guard, the session banner, the typed contracts (identical to CLI, never pre-filled) and kill's one-key contract, the ARMED/blocking surfaces (Ctrl-C exits the console), the Venues browser + keel brokers list, the help/glossary system, and the safety design notes (cursor resets, the read-only Account branch, the console runs no loop of its own). The READMEs contain no TUI/"dashboard" mention to amend (checked both), so no README change rides here.

Fixes #392