feat(spot): add --rag-only mode (skip DataPhase1, run RAG alone)

[cipher813]

Summary

• Adds `--rag-only` flag to `spot_data_weekly.sh` for post-incident surgical reruns where DataPhase1 succeeded but RAG failed downstream.
• Fetches 4 RAG secrets from SSM, runs `rag/pipelines/run_weekly_ingestion.sh` (real, non-dry-run), emits `Process=rag-ingestion` heartbeat only (skips `data-phase1`).
• Motivation: tonight's Sunday recovery. Last Saturday's SF cleared DataPhase1 at 2026-04-18T03:47 UTC (verified `s3://alpha-engine-research/health/data_phase1.json`) then RAG hung on the `.env`-sourced `RAG_DATABASE_URL` truncation. PR feat(spot): fetch RAG secrets from SSM instead of sourcing .env #60 root-fixed the bash-metachar bug; this PR gives us the operational verb to re-run the failed step alone.

Modes (now 4)

• `` / `full` — DataPhase1 + RAG, default scheduled-run shape
• `--smoke-only` — bootstrap + Phase1 `--dry-run`
• `--rag-smoke-only` — bootstrap + RAG secrets + submodule imports + RAG `--dry-run`
• `--rag-only` (new) — bootstrap + RAG secrets + RAG real ingestion; skips DataPhase1 entirely

Test plan

• `bash -n` syntax check passes
• After merge: `bash infrastructure/spot_data_weekly.sh --rag-only` from laptop — should fetch 2026-04-12 signals via the hardened `--from-signals` resolver (fix(universe_returns): unstick NULL return_5d rows + drop weekend signals #38) and ingest into Neon pgvector
• Heartbeat metric `AlphaEngine/Heartbeat{Process=rag-ingestion}` emits; no `data-phase1` heartbeat

🤖 Generated with Claude Code