fix(cpr-ai): align authenticated Codex turn contract

[DoRmAmMu1997]

What changed

• accept the Codex SDK's passive userMessage result item without classifying it as an agent action
• place the CPR strategy policy in developer_instructions and keep the user turn deliberately short
• require the exact configured model and prompt version in the structured response
• constrain confidence to the documented 0-10 scale in both the schema and prompt
• add regression coverage under PR chore: architecture docs, tests consolidated under Tests/, coverage floor 54.7% → 68% #116's consolidated Tests/ layout

Why

The authenticated synthetic smoke completed the required four read-only MCP calls, but the host then rejected the SDK's echoed user message as unexpected_agent_action. The same integration also sent the long-lived strategy policy as ordinary user content, which weakened the intended instruction boundary.

Impact and safety

• authenticated synthetic smoke now returns: HOLD validation=accepted_hold NO ORDER
• the agent still has exactly four frozen, no-argument MCP tools
• shell, web, workspace mutation, and trading credentials remain unavailable to the child
• malformed output, missing tools, unexpected capabilities, and runtime errors still fail closed to HOLD
• no entry, exit, broker, or order capability was added

Verification

• CPR AI suite: 68 passed
• master suite: 487 passed, 52 skipped
• market-health suite: 26 passed
• Signal Generators, Dependencies, and Data Extractors: 1089 passed
• Ruff, mypy (53 files), compileall, Bandit, and pre-commit passed
• one authenticated synthetic smoke passed before publication; it made a model call but no broker/order call

Stack

This PR is intentionally based on #116 (chore/docs-and-tests-restructure). Merge #116 first, then retarget this PR to main before merging it.

Co-authored-by: Codex codex@openai.com