fix: require execution claim before IBKR submission

[Pigbibi]

Scope and implementation

Close only the EX-05 missing-claim strategy submission path on base 072f01f.

• Explicit optional acquire_execution_claim callback follows run_strategy_core -> main.execute_rebalance -> runtime broker adapter -> execution_service.
• Every non-dry-run submission through this execution-service path requires the callback to succeed, including PAPER mode. Default/disabled dedup, absent store, empty key, false claim and claim exceptions cannot submit.
• Claim only when the first order is ready, latch failed attempts, and share one successful claim across a cycle's distinct intents. Accepted-then-timeout retains the marker; a reopened local store suppresses the next cycle.
• Preserve no-op, dry-run and existing rejection behavior. No callable/store in signal metadata, global broker patch, ContextVar, new public contract/framework/schema or dependency.
• Exactly four source files and their two existing test files: application/rebalance_service.py, main.py, application/runtime_broker_adapters.py, application/execution_service.py, tests/test_rebalance_service.py and tests/test_execution_service.py.
• No change to QPK pin 7f140f07ac89f0b4b88347a903906825dde11c39, lockfile, runtime config, workflows, RiskEngine, reconciliation baseline or expected_digests.

Actual local RED / GREEN

• Original two test files passed before changes: 62 passed.
• After isolating the existing execution lock fixture in a temporary directory, new base-implementation tests yielded 7 failed / 5 passed. A separate precise default-case RED confirmed one synthetic OrderIntent reached the injected submit through the full caller chain (not merely a helper test).
• Final focused run: 165 passed, 4 existing deprecation warnings. Files: test_rebalance_service, test_execution_service, test_runtime_broker_adapters, test_runtime_composer, test_request_handling, test_broker_reconciliation, test_ibkr_order_execution and test_paper_execution_admission.
• Coverage includes buy/sell missing prerequisites, false/exception latch, missing callback at execution_service, successful single submit, shared claim for multiple distinct orders, unknown outcome then repeat, no-op/dry-run/admission rejection. Existing execution behavior fixtures explicitly supply successful synthetic callbacks; original trading assertions/defaults remain.
• Ruff on all six files, git diff --check and added-line secret-pattern/manual diff inspection passed.
• Local environment was a read-only existing frozen dependency environment with current IBKR source overlay. Installed non-editable QPK, UES and HK revisions were checked against this worktree's uv.lock. It is not a full fresh IBKR installation or full local suite.
• Tests used env -i, isolated HOME/TMPDIR, socket/subprocess audit denial, Python -B, PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 and pytest -p no:cacheprovider. All accounts, quotes, orders and stores were synthetic/local temporary.
• Supervisor independently reported 103 passed across rebalance_service, execution_service, runtime_broker_adapters and broker_reconciliation with the pinned-QPK source-overlay environment and socket/subprocess denial; diff check passed.

Publication side-effect review

Fresh GitHub main matched the base; no overlapping PR (only unrelated dependency PR473).

• CI alone is triggered by pull_request or push to main. It uses frozen dependency installation, import-only startup validation, lint, pin/lock checks and unit tests.
• scripts/validate_cloud_run_startup.py sets inert synthetic configuration, imports the app and inspects Flask routes; it does not call any route, Gateway or broker.
• runtime-guard, runtime-target-lifecycle and execution-report-heartbeat use independent schedule/workflow_dispatch, not push/PR/workflow_run. Their reusable action calls are not reachable from this publication event. Deployment and reconciliation acquisition are workflow_dispatch-only.
• The only workflow_run successor is Dependabot auto-merge, whose branch predicate excludes this codex branch and main. No other reusable-workflow dispatch chain is present in CI.
  No deploy/config/Scheduler/IAM/Gateway/provider/broker/account/order operation was performed or authorized. Existing schedules were not changed or dispatched.

CI / disposition

Required CI SUCCESS at exact head 42b9869: https://github.com/QuantStrategyLab/InteractiveBrokersPlatform/actions/runs/33929659417 . Full frozen CI suite: 548 passed, 5 skipped, 5 warnings; startup import validation, Ruff, QPK pin and lock checks passed. Fresh exact-head readback: CLEAN, only the six authorized files, no review/inline findings. Ordinary squash merge completed as 4f98faf. Actual post-merge push CI SUCCESS: https://github.com/QuantStrategyLab/InteractiveBrokersPlatform/actions/runs/33929792421 ; 548 passed, 5 skipped, 5 warnings, all job steps passed. Worktree clean; branch/worktree retained. Engineering delivery COMPLETE, stopping for Supervisor archival. Merged normally after required success and fresh no-material-finding readback, without admin bypass, force push or auto-merge mode. First CI failure permits one sanitized read-only classification then stop, no patch/rerun under this authorization.

This does NOT prove shared-backend availability, physical-account fencing across instances/platforms, other paper/liquidation lanes, or complete recovery after unknown orders. It does NOT close all EX-05 and does NOT mean TQQQ/SOXL or live trading has recovered.