Retain exact seq2 replay sources for a git-bound inventory - #1102

Scope

Publish the five retained seq2 replay modules as exact source copies so the CC
can bind a new replay inventory to their landed git commit. These files were
private deployment glue and absent from seq2's runtime inventory; this PR
establishes their first git provenance and does not alter the old seal.

• Base commit: ef2fea1.
• Lane: lane:trading.
• Owned paths: blueprints/us-equities/paper-open-e2e/seq2-replay/, five source
  modules plus README with before/after SHA256 and byte counts.
• Landing order: Keep lane B stage latches separate from the operator STOP #1087 P1-exception, the currency incident Restore model-currency validation with sourced Fable and Astra landscape checks #1101, then this PR.
  Both preceding publication steps exist; this PR still needs local plus Astra
  reads and follows them in the landing queue.

SOTA sources

• CPython v3.12.3 unittest loader,
  f6650f9ad73359051f3e558c2431a109bc016664, loadTestsFromModule, and
  unittest.mock.patch:
  maintained discovery and SYN isolation already used by these sources.
  No new loader, order engine or testing framework is added.
• NAS frozen runtime source,
  8c95a50: the existing engine context the
  deployment glue exercised. This pin names the runtime/config source, not
  the previous git authorship of the replay modules.
• NautilusTrader2.0.0rc5,
  1b0a49d2792a9432a3aca3fcb617ce7a630d905e, crates/system/src/config.rs:
  retain the selected native engine and its bounded lifecycle unchanged.

Copy and privacy evidence

Files: test_wiring.py, test_go_issuer.py, test_sequencing.py,
test_unit_contracts.py and test_data_wiring.py. All five compare byte-for-byte
equal to the retained deployment copies. Before/after SHA256 and byte counts
are recorded in the adjacent README; every digest has its full preimage
published in this PR. No content, import, path, fixture or line-ending edit.

The unchanged ROOT/imports expect sibling bundle launch.py, issue_go.py,
launch_data.py, data_worker.py, configs and units. These are archival evaluator
inputs outside ordinary tests/ discovery, not a standalone runnable package.
The future seq3 consumer must use the CC's record of the LANDED source commit;
consumer implementation and executable sealing are outside this small PR.

The requested privacy read found no real keys/tokens, non-no-reply emails,
broker account numbers/ids, credential contents or verbatim owner quotes.
API variable names and synthetic-key/synthetic-secret are inert fixture data.
Scan protocol dates are not account numbers. Machine paths/marker names are
retained under the current privacy rule. Focused gitleaks returned rc0 with
zero findings; no allowlist or scan configuration changed.

Evidence-class table

Local commands run

env TMPDIR=/var/tmp <managed-python-3.12> -E -s -B /var/tmp/seq2-replay-copy-check.py <private-seq2-source> blueprints/us-equities/paper-open-e2e/seq2-replay
# rc0:5/5 raw bytes and before/after hashes equal;5 syntax checks;0 imports/executions
systemd-run --user --scope -p CPUWeight=idle --quiet -- env TMPDIR=/var/tmp gitleaks dir blueprints/us-equities/paper-open-e2e/seq2-replay --no-banner --redact=100
# rc0: no findings

Repository validation, whitespace, merge-tree and normal publication gates
are recorded in the private lane report with their actual exit codes. The
base's model-currency incident is handled separately in #1101; this PR does
not change currency inputs or bypass that check. Whole-tree validate returned
rc1 for the existing claude-fable-5-1 landscape-age failure at this base; it is
not reported as a pass. No new runtime behavior was
implemented, so no manufactured fail-first behavior claim is made for copying.

Decision record

blueprints/us-equities/paper-open-e2e/seq2-replay/README.md documents the
exact-byte provenance, privacy disposition and separate future inventory gate.

Host evidence

No new host receipt or status change. Original deployment bytes, STOP/HOLD,
receipts/journals, writer state and units are untouched. No service, broker,
credential or GO action.

Checklist

• Fresh worktree from origin/main; inherited no-reply identity.
• Trading/root subtree instructions read; no narrower AGENTS exists here.
• Exactly five unchanged source files with before/after hash evidence.
• Privacy scan green; no dependency, secret, paid data or workflow addition.
• Local and Astra reads.
• Land after Keep lane B stage latches separate from the operator STOP #1087 and Restore model-currency validation with sourced Fable and Astra landscape checks #1101; CC binds the landed commit in a new record.

Follow-ups

• After landing, CC computes git-show hashes and seals the authenticated replay
  inventory. Then integrate that binding into seq3's consumer and run its full
  strict-seal/SYN/validity process; never edit the original seq2 seal.
• Keep lane B stage latches separate from the operator STOP #1087's Python3.13 probe portability and unit-path quoting remain its P2s.
• No historical strategy, qualification or performance claim follows from
  publishing these SYN replay sources.