fix(risk): restore hard exposure and trailing-state gates

[Pigbibi]

Summary

• replace closed-unmerged chore(deps): align QPK pin to b371322b948e #114 from the same exact base without dropping its QPK pin, member-risk evidence, stop-evidence, concentration, or hard max_positions=20 fixes
• enforce strategy-local gross target exposure <= 1.0 independently of QPK MEMBER approval; invalid/non-finite weights fail closed
• reject missing, non-finite, non-positive, or semantically invalid persisted held highest_price before trailing-stop evaluation can emit CLEAR

Safety boundary

Offline code/CI evidence only. This PR does not authorize merge, runtime/provider/credential/deploy/config-sync, broker/account/order/capital, paper/shadow/live, observer execution, or MATCHED.

Tests-first evidence

• exact chore(deps): align QPK pin to b371322b948e #114 head RED: hard total exposure and invalid held highest_price regressions failed as expected
• focused GREEN: 2 passed, 7 subtests passed
• focused files: 16 passed, 11 subtests passed
• full suite: 107 passed, 72 subtests passed
• Ruff, compileall, pip check, package build, QPK pin/lock, diff/scope, and secret-like addition gates: pass

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e25ae2065

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1fa75756d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".