Hard-disable live execution capability

[howdymary]

What changed

• adds a dependency-free, unconditional live-execution safety gate
• makes LiveTrader construction, placement, and internal submission fail before adapters or flags are inspected
• makes Polymarket place/submit/cancel and raw authenticated-client retrieval fail before credentials, market lookup, injected clients, or network use
• removes LiveTrader from the public live package export and removes the published Polymarket trading extra
• replaces the legacy live runner with a standalone fail-closed script
• changes the safety audit so credentialed live configs are always NO-GO while capability is disabled
• adds installed-wheel CI probes for direct constructor, __new__, injected-client, venue mutation, entrypoint, and audit bypasses
• adds versioned NO-GO, threat model, disabled-live runbook, evidence-manifest template, SECURITY policy, and issue Packet 8: conduct an independent live-safety readiness review #11 acceptance map
• removes obsolete unreachable live-cycle code and tests while preserving public read-only scan and durable shadow replay

Why / root cause

Supported commands were disabled, but direct Python imports could still construct a live trader or call authenticated venue mutations. The former safety audit could also report success for a credentialed live configuration without operational evidence. That was a capability and product-claim mismatch.

User and developer impact

No credential, configuration, confirmation flag, injected adapter/client, direct import, or installed-wheel path can enable live submission in this release. Public scanning and shadow replay remain supported. Operators receive an explicit NO-GO and a concrete evidence template for any later, separately authorized readiness project.

Schema and migration

• removes the optional polymarket trading dependency extra from the published package
• retains import compatibility for autopredict.live.trader.LiveTrader, but construction and mutation always raise LiveExecutionDisabledError
• removes the public autopredict.live.LiveTrader re-export
• safety-audit output now records live_execution_capability_enabled: false and fails any live request

Verification

• independent safety code reviewer: APPROVED
• independent release tester: APPROVED
• focused safety/live/shadow/scan suite: 84 passed
• full suite: 455 passed
• Python 3.9 and 3.12 compile audits: 164 files passed
• Black 26.5.1, exact CI mypy target, and git diff --check: passed
• sdist/wheel build, clean install, and recursive import audit: passed
• installed direct-bypass probes all raise LiveExecutionDisabledError
• source and installed shadow replay process six events deterministically
• read-only scan works with injected public data while socket access is denied
• no venue endpoint, credential, order, or cancellation was used

Readiness decision

NO-GO. Live execution remains disabled. Seven days of clean representative shadow evidence do not exist, and no later human-authorized live-enablement project has approved the capability. This PR cannot and does not satisfy those future gates.

Residual risks

• retained internal authenticated position/balance methods terminate at the raw-client gate; compatibility is intentionally reduced while live is disabled
• the generic MarketAdapter protocol still describes mutation methods, while the concrete Polymarket implementation fails closed; removing those protocol members is broader API cleanup

Tracks #2
Closes #11