fix: stop Schwab submissions after an unknown broker outcome

[Pigbibi]

Scope

Audit F1: one cycle-wide halt after uncertain submit, malformed/unknown response, ambiguous HTTP failure, or failed post-ACK processing. Preserve original intent, known order ID and ACK without claiming a fill. Skip sell-refresh/resume after halt. Append submitted/unknown orders to the existing outcome store without replacing its claim. Notification failures are sanitized and cannot discard pending outcomes.

Verification

• Tests-first: timeout buy/sell/notional and prior-ACK cases failed on base, then passed. Review follow-ups cover retained broker IDs and caller/store notification failures.
• Final targeted offline suite: 108 passed. Earlier exact CI selection: 90 passed; new regression file is now included in CI.
• Full Ruff, installed dependency compatibility and diff checks passed. Actual QPK d51bb79 / UES 59a6e43 match lock.
• Eight existing rebalance fixture failures reproduced identically on pristine base archive (missing account observation); not changed or represented as a green full suite.

Boundaries

No deployment, config sync, provider/broker/account or order operation. Deploy workflow is dispatch-only; this main push runs CI only. A code/test fix does not establish production adoption or completed reconciliation.