feat: add explicit R1-S2 capability contracts

[Pigbibi]

R1-S2 Phase 1: capability foundation

• spec: R1 redesign v1, Phase 1
• base_sha: 9039d59
• adds pure BacktestRequest/BacktestCapabilities v1, PersistMode, ExecutionTiming, validation, legacy declaration, canonical fixture serialization
• immutable keyword-only requests; fail-closed version/timing/ephemeral validation

Scope guard

No changes to BacktestOrchestrator, BacktestResult, PerformanceStore, runners, wrappers, or production call paths. No IO/store/runner invocation/artifact generation. PR #248 remains frozen evidence.

Validation

PYTHONPATH=src python3 -m pytest -q tests/test_backtest_capabilities.py (8 passed)
PYTHONPATH=src python3 -m pytest -q tests/test_backtest_orchestrator.py tests/test_param_optimizer.py (12 passed)
PYTHONPATH=src python3 -m compileall -q src/quant_platform_kit/strategy_lifecycle
ruff and git diff --check passed

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: blocking findings were cleared by independent Codex arbitration

⚖️ Codex Review Arbitration

✅ clear: The prior high-severity logic issue is demonstrably fixed in the current source of truth. In src/quant_platform_kit/strategy_lifecycle/capabilities.py, serialize_request() now serializes "profile": canonical_profile_id(request.profile) instead of the raw profile string, and canonical_profile_id() normalizes aliases such as soxl_soxx_trend_income and SOXL to the same canonical ID (SOXL). tests/test_backtest_capabilities.py also proves the contract by asserting that an alias-based request serializes to the same fixture shape as the canonical profile. With no remaining current findings and the historical blocker fixed by code plus contract tests, the PR should be cleared.

ℹ️ Other Findings

1. 🟡 [MEDIUM] Reliability in src/quant_platform_kit/strategy_lifecycle/capabilities.py

BacktestCapabilities is declared frozen, but execution_timings and persist_modes are stored exactly as passed. If an adapter constructs it with a normal mutable set (for example BacktestCapabilities(execution_timings={ExecutionTiming.NEXT_OPEN})), later mutation of that set changes the published capability object in place. That makes capability checks nondeterministic and can create racey accept/reject behavior if the same contract object is shared across requests. (line 53)

Suggestion: Normalize these fields in BacktestCapabilities.__post_init__ by coercing them to real frozenset instances and validating their members are ExecutionTiming/PersistMode values before storing them.

2. 🟡 [MEDIUM] Logic in src/quant_platform_kit/strategy_lifecycle/capabilities.py

The PR describes serialize_request() as canonical fixture serialization, but _freeze/_thaw preserve the original mapping insertion order instead of normalizing keys. Two semantically identical requests with the same nested parameters inserted in different orders will therefore produce different serialized structures when emitted to JSON or hashed, which can break fixture stability, cache keys, or artifact identity. (line 31)

Suggestion: Sort mapping keys recursively during freeze/serialization (or emit a canonical JSON string with sorted keys) so equivalent parameter maps always produce the same serialized form regardless of construction order.

---

Review by Codex PR Review bot • PR