Harden canonical risk metadata and retire Global mandate

[Pigbibi]

Summary

• sanitize all decision, snapshot, mandate, normalization, and TQQQ risk-control material before canonical hashing
• call RiskEngine.assess exactly once on supported evidence and legacy gate paths, including malformed static input
• retire the exact Global ETF research mandate before generic fallback and clear positions/budgets on every rejection

Root cause

External typed metadata could reach float conversion or canonical JSON before validation. Oversized integers, non-finite numbers, unsupported objects, and noncanonical Unicode could throw or be accepted instead of producing a deterministic fail-closed rejection. The merged Global mandate also still had an approval path on main.

Validation

• tests-first c967 RED: 161 failed, 59 passed, 147 subtests passed
• uv sync --frozen --extra dev
• uv lock --check
• python -m pytest -q tests/test_risk_gate.py: 62 passed, 305 subtests passed
• ruff check .
• full coverage suite: 948 passed, 1 skipped, 365 subtests passed
• python -m compileall -q src tests
• python -m pip check
• python -m build
• fresh wheel install and import
• diff/path-ceiling/secret and provider-URL gates

Scope

Only src/quant_platform_kit/risk/gate.py and tests/test_risk_gate.py changed. No downstream pin, platform, pipeline, strategy, provider, runtime, or execution changes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27b786a761

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".