feat: add read-only IBKR continuity reconciliation

[Pigbibi]

Summary

• add a POST /reconcile endpoint that uses a Gateway read-only session
• collect scoped identity, positions, cash, all active orders, recent executions, and durable execution-ledger evidence
• publish only content-addressed digests and stable blockers; missing legacy evidence remains RECONCILE_ONLY

Validation

• PYTHONPATH=. PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 uv run --no-sync python -m pytest -q tests/test_broker_reconciliation.py tests/test_runtime_broker_adapters.py tests/test_deployed_runtime_target_admission.py
• uv run --no-sync ruff check main.py application/broker_reconciliation.py tests/test_broker_reconciliation.py

No route changes a live-continuity state or submits an order.