Fix RFQ → EOPP signed-source participation capture

[blackmore-technology-group]

Closes #117.

Fix

RFQ executions now preserve a deterministic trade_id → rfq_id → quote_id → acceptance_id source binding in rfq_trade_sources, signed by the venue operator at execution time. EOPP verifies the exact signed RFQ request, provider quote, requester acceptance, trade economics/participants, and the venue-signed execution-source binding before capturing originator participation.

The order-book path remains unchanged and continues to require the signed sell order. No heuristic RFQ lookup or weakened authority check is introduced.

Market Recovery treats the new table as an optional extension for backward compatibility with older sealed bundles.

Fail-closed coverage

Added tests proving:

• BUY-RFQ primary participation captures end-to-end.
• SELL-RFQ secondary royalty captures without using the seller's private key during EOPP capture.
• missing rfq_trade_sources binding fails closed with no economic event committed.
• tampered quote signature fails closed with no economic event committed.

Qualification

Final exact-byte qualification on Python 3.11.9 with the existing v3.4.3 qualification site + ADAM v1 root:

• 24/24 EOPP targeted tests PASS.
• 16/16 exchange convergence tests PASS.
• 7/7 Market Recovery tests PASS.
• manifest-sensitive selection: 35 passed + 27 subtests.
• full tests/ suite: 293 passed + 27 subtests, 0 failures.

Commit 6d4ca42c6e6c4224ce480be62ecc2eca9fb5d2ab is SSH-signed with the BTG ENTITY release-signing key.