Nightly build nightly-2026-07-23

Sanitize the last real-ticker fixture and close the guard gaps

tests/positions_iron_condor.json held a real SPX weekly condor (SPXW,
strikes 5900/5880/6050/6070) and a 300-share SOXL lot with cost basis. It
survived the earlier sanitization because that pass only covered
tests/fixtures/ and this file sat one directory up.

Fixture is now synthetic (EPIC/EPICW + BOLT) and moved under tests/fixtures/
so the "fixtures are synthetic" rule covers everything by construction. Both
spreads keep their 20-wide geometry, so the payoff assertions are unchanged.

Guard gaps this exposed:
  - a CI log once landed as run_log.txt, which the hook's \.log$ pattern
    does not match; added log.txt / *_log patterns
  - the account-number check silently did nothing when no guard was
    configured; it now warns instead of appearing to pass
  - .gitignore carries the same patterns, since the hook only sees staged
    content and --no-verify skips it

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>