fix(polymarket): bound preflight and run a strict 900-second Rust Gate

[proerror77]

Parent

#499

What to build

Replace the mixed-duration Polymarket release Gate with a bounded preflight and
one strict 900-second Rust observation. Preflight must verify the exact signed
release, production unit safety, a current policy-clean atomic Python health
publication and captured Python identity, and one mature real closed segment
through the candidate uploader and independent OSS readback. During the Gate,
Python identity must remain stable but no new Python cycle is required. Rust-self
evidence from the new shadow spool must verify live data and runtime integrity
without appending another settlement-maturity wait. After immutable evidence is
validated, promote and verify the three Rust services with Python rollback.

Acceptance criteria

• The complete preflight has one 300-second wall-clock deadline and fails
  before shadow startup when it expires.
• Preflight validates exact artifact/source/control identities, canonical
  units, permissions, drop-ins, cutover dry-run, current policy-clean atomic
  Python health, and captured Python PID/invocation/restart identity.
• A mature real closed segment passes candidate format, settlement/upload
  compatibility, immutable OSS triplet, and independent readback checks.
• The formal observation timer is exactly 900 seconds; 899-second evidence
  fails and no maturity or parity tail is appended after 900 seconds.
• Python identity remains unchanged for the whole Gate, while a new Python
  health completion is explicitly not required.
• Rust shadow PID, invocation, executable SHA, health progress, data progress,
  rotation, deduplication, required record classes, and resource health remain
  fail-closed.
• Rust-self evidence is accepted only for the declared legacy-Python lane and
  cannot bypass any Rust, OSS, immutable identity, or data-quality check.
• Final evidence is immutable and independently read back before cutover.
• Cutover promotes all three services to the exact Rust candidate, validates
  procfs executable SHA and output manifests, and rolls back Python on smoke
  failure.

Runtime control

• Target: ECS i-6we6afeqsvv8uo1ixmyo and its three canonical Polymarket raw-ops services.
• Candidate: PR fix(polymarket): bound production Gate to 900 seconds #501 head 3214966; after merge, only the exact-main digest-addressed artifact and its independently read-back hashes may deploy.
• Controller: /root is the sole production controller.
• Stop rule: Any identity, policy, real-segment, 300-second preflight, 900-second Gate, parity, OSS, health, resource, or immutable-evidence failure stops shadow and preserves Python.
• Rollback: Use the exact cutover evidence directory with the existing fail-closed rollback path; a failure during the 300-second production smoke restores the captured Python units.

Blocked by

#505

Out of scope

CI workflow restructuring, research, snapshot/#235, evaluator/MCTS, collector
feature changes, and overwriting old immutable releases.