fix: reject nested account action fields

[Pigbibi]

Summary

• recursively reject account-action keys anywhere in an advisory artifact
• cover broker, order, account action, target quantity, target weight, and camel-case variants
• report only offending key paths and leave ordinary research text untouched

Validation

• python -m pytest -q
• 300 passed
• ruff check on changed files
• git diff --check

V5/V6 assessment

The default producer still emits schema v5, which intentionally rejects v6 expiry and freshness fields. Artifact and manifest digests already exist downstream, but the default report does not carry a top-level input-content digest. Flipping the default should be a separate dual-read v6 migration because preview bundle, workspace, D3 evidence scripts, and workflows currently pin v5.

Safety

• no broker or live integration is added
• no account allocation fields are introduced
• validation becomes fail-closed for nested execution-shaped data