fix(polymarket): migrate trade history to Data API v2 - #133

Closes #132.

Use Polymarket Data API v2 trade history through /v2/trades, condition and opaque cursors. Parse snake_case records, preserve filters across short or empty continuation pages, reject malformed or repeated cursors, and retain the normalized trade schema. Apply requested inclusive time bounds locally because market-scoped v2 requests ignore them. Document the server's rolling three-year history limit. CLOB prices and Gamma listing are unchanged.

Preserve published trade identifiers across v1/v2 numeric encoding. Actual v1 responses encode whole quantities as integers, while v2 returns floats. Hashing 38 versus 38.0 changed 10 IDs for 12 identical observed fills. Normalize whole numeric identity values before hashing. A public fetch_trades regression uses authentic v2 responses and legacy IDs recorded from the immutable published 0.3.0 provider; it fails on 29ca79c and passes with the fix. Fresh unchanged live v1 and repaired v2 workflows produce identical normalized 12-row frames, including every trade ID and numerical value. The announced v1 retirement is not misreported as an observed outage: the old route still responded on October 25.

Adopt the reviewed shared qualification correction from ml4t/ecosystem#57 in both the ordinary ecosystem workflow and Release workflow. Pin merged revision 322df8513e6f7dceae8eab9d9697b3428ee62af6 and the Data-only python-315-data-databento-030 exception for >=0.3,<0.4. The reusable workflow pins its actual policy to 728da8e1175c4ad55c5feb6365d195a4f6a045c0. All supported Python 3.12-3.14 operating-system gates remain mandatory. Fresh complete Python 3.15 installation still fails on released Databento 0.88.0 dependencies; core installation and 66 tests pass. Issue #37 remains open.

The uv-generated GitPython 3.1.62 -> 3.2.1 lock repair removes the reproduced development/docs audit failure. Runtime dependencies are unchanged by that GitPython repair. A fresh required audit subsequently reproduced three newly reported vulnerabilities in locked filelock 3.32.2 (CVE-2026-112940, CVE-2026-112913 and CVE-2026-112907). Raise the runtime minimum to patched 4.2.1 and lock 4.2.4. The complete all-extras/all-groups audit now reports no known vulnerabilities. The 186 locking/storage/snapshot/utility checks pass at both minimum 4.2.1 and locked 4.2.4; no advisory is suppressed.

Verification: 111 focused Polymarket/history/registry/consistency tests pass; authentic failing-base and passing-fix evidence is retained. The live identity comparison passes on 954f199. Revision 7198d23 passed both full lanes (4,542 tests each, 85.74% coverage), quality, docs, clean installs and the real hosted shared exception validator. Revision f8e6a38 adds the filelock audit repair; its hosted audit and exception validator pass. Its macOS 3.13 lane exposed an existing wall-clock test assumption: a valid late wake-up left 0.383 seconds on a rate-limit window, below the test's assumed 0.4-second floor. Controlled elapsed-time checks now verify the initial countdown, half window, late wake-up, exact expiry and expired window without changing production behavior. The original test fails with an actual 0.62-second wake-up. All 18 rate-limit cases pass with the repair, and an isolated producing-code defect that ignores elapsed time is rejected by the new regression.

The sibling blocking test also reproduced a legitimate delayed wake-up failure against its 0.7-second upper bound. It now verifies the exact requested blocking wait, denied nonblocking admission and correct admission/quota after the window expires using a module-local clock and wait primitive. A real producing arithmetic defect requesting 0.6 instead of 0.5 seconds fails the new test; all 18 async cases pass normally.

Final revision 5b749da contains every repair. Both final local suites pass 4,542 tests (85.74% coverage), with ResourceWarning errors enabled separately. Ruff, formatting, ty, actionlint, strict docs, builds, all hooks and clean wheel/sdist installations pass. Both artifacts independently match all 177 source files at the exact revision. All 28 final hosted checks completed: 27 passed and the sole Python 3.15 skip was validated by the approved scoped exception. Ordinary matched-head merge landed as a213df5; its entire source tree matches the reviewed head. Issue #132 is closed. Interrupted obsolete f8e6a38 and 764b3df full runs are retained as partial evidence only. Earlier-head green checks are not substituted for final qualification. No release or deployment is included; published 0.3.0 stays immutable.

Thanks to the issue reporter for identifying the migration. AI assistance: Codex implemented, reviewed and verified this maintainer-directed repair, real API regressions and qualification adoption. The maintainer owns correctness and final qualification.