feat: archive private IBKR recovery evidence

[Pigbibi]

Summary

• optionally archive the full private baseline candidate and dual-review receipt alongside the redacted QRS source snapshot
• restrict archive URIs to the IBKR recovery-source prefix
• write with GCS if_generation_match=0 so evidence cannot be overwritten

Safety

• QRS ingress still receives only the redacted snapshot
• archive path never reads, lists, deletes, or overwrites objects
• no broker, Cloud Run, execution-marker, or order operation is added

Validation

• python3 -m compileall -q scripts/publish_reconciliation_recovery_source.py tests/test_reconciliation_recovery_source_publisher.py
• direct focused private-evidence publisher checks
• uv lock --check
• python3 scripts/check_qpk_pin_consistency.py

GitHub CI will run full checks.