fix: require writable IBKR gateway readiness

[Pigbibi]

Summary

• Require a positive, non-zero healthcheck client ID.
• Require READ_ONLY_API to be explicitly configured as yes or no; writable deployments must declare READ_ONLY_API=no.
• When writable access is expected, verify API readiness with reqOpenOrders and fail closed if IBKR explicitly reports read-only mode.
• Keep the readiness probe non-mutating and redact managed account identifiers from logs.
• Preserve fractional timeout values when calculating the temporary IBKR request timeout.

Root cause

Gateway readiness previously proved socket/API login and managed-account discovery, but did not require an explicit writable configuration contract. A container could therefore be marked ready while its configured API mode was ambiguous or read-only. The old success log also exposed managed account identifiers, and the initial timeout conversion rejected valid fractional values.

Behavior and safety

• READ_ONLY_API=no is the Gateway-side writable configuration contract.
• reqOpenOrders is a supplemental non-mutating API readiness check; it does not independently prove order-write permission.
• End-to-end order-write capability is checked by the Platform runtime with an IBKR what-if order.
• Generic API error 321 is not treated as read-only unless the message explicitly indicates read-only mode.
• Completed-order history is not required.
• Raw socket fallback is refused when writable access must be verified.
• Existing Gateway settings and event handlers are restored after the probe.

Validation

• Gateway readiness shell regression suite: passed
• bash -n: passed
• ShellCheck for the script and test: passed
• git diff --check: passed
• Codex plugin review on ddb4150525: no major issues

Deployment note

The production write path was verified independently through the Platform runtime. This Gateway readiness change has not yet been deployed and remains gated on normal review and deployment.

[Pigbibi]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 188602c347

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: ddb4150525

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".