Retain actual signed full execution and separately recognize trade-date accounting

Verified non-API-key exact configured service with ledger:securities:bridge required. Only the retained exact program bridge can submit signed actual full execution or zero-fill cancellation/rejection. Actual execution binds bank/master/custody, full quantity, price/fee/cash limits and confirmation bytes. BUY recognizes security cost and purchase payable; SELL derecognizes book assets and creates receivable while physical units remain reserved until DVP. The actual receipt is retained before recoverable native ledger accounting. All mutations require verified authority even in local mode; customers and API keys are refused. Evidence JSON is strict and bounded at 5 MiB; complete responses are bounded at 16 MiB and never silently truncated.