feat: add deterministic plugin signal envelope v2

[Pigbibi]

Scope

• add a pure-local qsl.strategy-plugin-signal.v2 envelope builder and strict validator
• bind signal payloads to immutable producer revision, code/config hashes, P1 manifest/root hashes, cutoff, and a verified canonical JSON SHA-256
• reject mutable latest references, unknown/missing fields, non-JSON values, execution/authority fields, and AI/LLM payload fields
• document the DESIGN_ONLY boundary and add fixtures plus targeted tests

Deliberately out of scope

• no market-regime producer or legacy resolver integration
• no strategy/runtime/workflow/GCS/data/broker changes
• no P2/P3/P4/P5/P6 wiring or authorization

Validation

• python3 -m py_compile src/quant_strategy_plugins/plugin_signal_envelope_v2.py tests/test_plugin_signal_envelope_v2.py
• uv run --locked --with pytest pytest -q tests/test_plugin_signal_envelope_v2.py (18 passed)
• uv run --locked --with ruff ruff check src/quant_strategy_plugins/plugin_signal_envelope_v2.py tests/test_plugin_signal_envelope_v2.py