fix(risk): close Global ETF evidence gaps

[Pigbibi]

Summary

• bind Global ETF loss-budget sizing to completed_session_equity in currency terms and include that normalized value in the portfolio evidence digest
• normalize all Global ETF risk-control scalar/string digest material before canonical hashing so malformed values reject without raising

Exact corrective scope

• closes PR feat(risk): add Global ETF research mandate contract #303 findings r3741333381 and r3741333385
• changes only src/quant_platform_kit/risk/gate.py and tests/test_risk_gate.py
• preserves frozen Global mandate caps and existing TQQQ/bootstrap/fallback semantics
• remains RESEARCH_ONLY with execution_authorized=false; no runtime or order authority

Evidence

• RED: 14 failed, 1 passed, 52 deselected, 4 subtests passed
• focused GREEN: 3 passed / 16 subtests; Global suite 9 passed / 61 subtests
• full: 941 passed, 1 skipped / 192 subtests
• Ruff, compileall, lock, dependency compatibility, package/install/import, scope2, secret, provider-URL, and diff gates passed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 230084b6cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject oversized completed-equity integers before conversion

When a Global ETF snapshot supplies completed_session_equity as an arbitrarily large integer (for example, 10**400, which Python's JSON decoder accepts), _finite_number calls float(value) and raises OverflowError. This escapes assess_with_evidence instead of producing the intended fail-closed invalid_completed_session_equity rejection, so the new evidence boundary can still crash on malformed input.

Useful? React with 👍 / 👎.