fix: stop order cycle after unknown broker outcome - #461

Scope

Fix audit F1 in the execution/caller boundary only. Stop every later order submission in the cycle after an uncertain broker outcome; retain the original intent, known broker order ID, and immutable claim. Explicit local rejection remains distinct. Preserve ACK/fill facts before fallible notification/hooks; write pending outcomes with the existing append-only store API.

Verification

• Fresh base: e7377ef.
• Actual old-base RED with final regression tests: 7 failed (including 3 subtests), 2 passed.
• Patched focused suite: 95 passed, 1 skipped, 11 subtests passed.
• Full offline suite: 479 passed, 1 skipped, 58 subtests passed; the skip requires POSIX timezone switching.
• Full Ruff, locked environment package consistency, and git diff checks passed.
• Tests used a dedicated frozen/offline environment under OS network denial and an empty inherited environment. No provider/broker/credentials or production operations.

Boundaries

Exactly two application files and the existing rebalance test file. No strategy, risk, Policy A, dependency, deployment, configuration, or scheduler changes. PR/main CI tests already include this file. Deploy Cloud Run is manual-only; no deployment follows this PR or main push. Local synthetic and CI success do not establish runtime recovery or actual broker reconciliation.