feat: DataPhase1 preflight — fail-fast credential + dependency checks

[cipher813]

Summary

• New `validators/preflight.py` runs at the START of `_run_phase1` before any collector executes.
• Catches credential drift, external-API outages, and S3/ArcticDB misconfiguration in ~10s instead of ~55min into a doomed spot run.
• Complements postflight (PR feat: DataPhase1 postflight — producer-side consumer-contract checks #52, output-contract checks AFTER writes) — same failure surface, opposite side of the pipeline.

Five checks (cheapest-first)

1. Required env vars present + non-empty (`POLYGON_API_KEY`, `FRED_API_KEY`)
2. S3 bucket HEAD + sentinel PUT/DELETE (validates IAM beyond list)
3. ArcticDB connect + `universe`/`macro` libraries present
4. FRED reachable + auth valid (DFF observation call)
5. polygon.io reachable + auth valid (reference-data call)

Failure surface

`PreflightError` → `results["status"] = "preflight_failed"` → `SystemExit(1)` → SSM → SF HandleFailure → `alpha-engine-saturday-sf-failed` alarm. One named failure, one alarm.

Scope-out

• Skipped on `--only ` (single-collector debug runs don't need preflight).
• Skipped on `--phase 2` (Lambda has different deps; its own preflight when needed).
• Does NOT do value-range / outlier validation — tracked as P2 in ROADMAP.
• Does NOT do schema-registry-style contract validation — tracked as P3 in ROADMAP.

Test plan

• 24 new unit tests cover each check + end-to-end `run()` ordering + short-circuit on first failure.
• Full data-module suite: 84 passed, zero regressions.
• Saturday 2026-04-18 00:00 UTC live validation: `spot_data_weekly.sh` should log `preflight: all DataPhase1 fail-fast checks passed` within ~10s of bootstrap completing, before `COLLECTING: constituents`.

Composes with

• PR feat: DataPhase1 postflight — producer-side consumer-contract checks #52 (postflight) — preflight + postflight together gate every input AND output of DataPhase1.
• ROADMAP P2 (per-collector value-range guard) — middle layer between the two, catches in-flight bad data.
• ROADMAP P3 (data contract registry) — eventual unification of all five callsites currently hand-rolling each contract.

🤖 Generated with Claude Code