fix: require explicit live lifecycle authority

[Pigbibi]

Summary

• make incomplete strategy metadata fail closed instead of defaulting to live-capable
• require explicit runtime_enabled, can_switch_live, live execution mode, and live lifecycle status in backend and Worker checks
• accept canonical live_enabled while preserving legacy runtime_enabled deployments
• document canonical lifecycle names and the catalog-versus-deployment authority boundary

Compatibility

• existing fully configured live profiles remain unchanged
• legacy runtime_enabled is accepted only when every independent deployment gate is explicitly present
• no strategy, broker, account, or live permission is modified

Validation

• 114 Python tests passed
• Worker validation passed
• config check, Ruff, py_compile, and diff check passed