Stop the carry reporting layer stating things that are not true

Ports the reporting guards Oreka grew after the extraction back into Ainara's
own carry stack. Every one of these was a live defect here, not a stale copy
of someone else's: none of the guards existed in this tree. They are pure
computation over data already fetched, so none of it needs the venue SDKs and
none of it is affected by the httpx conflict that blocks installing Oreka.

incomplete_window. A review window that caught a trade's CLOSE but not its
OPEN reconstructed it as a live position, with entry_px set to the price the
CLOSING order filled at. The venue's current size settles what fills alone
cannot: a trailing episode the venue says is not there is a window that does
not reach back far enough, and it is labelled as one instead of invented as a
position. A failed size read leaves the reconstruction exactly as it was.

The lookback default. It was 7 days against a strategy that holds for 14,
which is what put the reconstructor in that state to begin with. Now derived
from expected_hold_days with a 90-day floor.

Data quality. Analytics now refuses numbers a delta-neutral hedge cannot
produce, and reports the fault instead of the figure. Faulted trades are
excluded from total_realized_net_usd and from every headline rate. The
completeness check is first and matters most: a window clipped at both ends
counts no fills, sums to $0.00 and reports exactly what a healthy hedge
reports, so no magnitude test can catch it.

Two denominators. Funding rates and net returns are earned against different
bases; both are now named rather than implied, with notional_basis stating
what this build cannot account for rather than letting them be assumed equal.

Liquidation nulls. A missing positionValue divides out to 0.0, not None, so an
unreadable mark was rendering with the benign "not liquidatable by price
alone" note. The Hyperliquid leg now carries a note in both cases and says
which one it is. The dashboard already refuses to paint a null as safe.

Inherited watchdog alarms. _alarm_published starts False in each process and
only its own branch removes the file, so a watchdog replacing a crashed one
never cleared that one's alarm - and inside the freshness window it read as a
live emergency raised by a process that no longer exists. It is adopted rather
than deleted, keeping its original timestamp so it ages honestly, and retired
on the first clean poll.

50 new tests (165 trading tests total). The 4 pre-existing bech32 import
errors are unchanged - those modules need the executor venv.

NOT ported: the predicted-vs-holding `benchmark`. Ainara has no equivalent, so
it cannot commit the error the guard exists to prevent, and building one needs
a mark series and execution-cost modelling this tree does not have. A
benchmark that cannot stand behind its verdict is worse than none.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: jzbtc101