feat: canary venue oracle — testnet wired, live gated

[ArthurBernard]

Summary

• Venue identity oracle (broker-port-only): our fills == venue-reported fills (exact triples), per-asset balance deltas == the fills math (fee-denomination-aware — never an assumed zero), flat position, bounded cost. A settle loop attributes the venue's async executions to our client-order-ids and re-emits them through the ordinary fill plumbing.
• --mode testnet (Binance sandbox; Kraken refused — no testnet), --mode live behind the EXISTING live_enabled gate + typed confirmation; 09-go-live.md names the live canary as the road-to-1.0 work on the IQ Option #1 validation vehicle.
• Evidence-forced domain hardening (ADR in this PR): Fill.fee_asset (+store migration — Binance charges market-buy commissions in BASE; caught by the oracle refusing an unexplained −8E-8 BTC), Binance HTTP-400 {code,msg} → domain-error mapping (they escaped as transport errors), BrokerConfig.symbols (Binance myTrades is per-symbol), venue probe offset 15 % (PERCENT_PRICE_BY_SIDE rejects 50 %).
• Final leaf of the canary-roundtrip plan tree (docs: plan canary-roundtrip #220) — closes the epic AND the whole 2026-07-11 UI-consistency roadmap section (all six epics shipped; roadmap section rewritten as shipped, status updated, tree archived).

Test plan

• python -m pytest — 1480 passed, 1 skipped, cov 96.24 % (8 fake-broker oracle tests, 7 CLI gating tests, HTTP-400 mapping, store migration)
• python -m pytest -m network — 9 passed incl. the real-testnet canary smoke
• ruff check + ruff format --check green
• REAL Binance testnet run: trading-bot canary --exchange binance --mode testnet → exit 0, 16/16 PASS — real cancel accepted, duplicate client-order-id deduped venue-side, fills identity exact (ids 4064265/4064266), base fee −8E-8 BTC explained by fills math, cost 0.00511 USDT ≤ 2. Two intermediate failures were real findings, fixed + offline-tested before the green run. Mainnet keys and --mode live never used
• CI green