fix: align legacy plugin policies with V2 no-order boundary

[Pigbibi]

Summary

• downgrade market_regime_control v1 consumption policies to notification-only for TQQQ and SOXL
• keep legacy position-control-shaped fields readable for deterministic replay
• add a runner-level fail-closed guard so policy metadata cannot restore direct allocation authority
• align the catalog and lifecycle documentation with the V2 sidecar boundary

Validation

• uv run --frozen --extra test python -m pytest -q
• 181 passed
• ruff check on changed Python and test files
• git diff --check

Safety

• no broker calls or live permissions are added
• position_mutation_allowed and broker_order_allowed remain false
• strategy-owned candidates must pass the central Risk Gate for any position target