Port the Norgate producer tests §7.1 left behind

[mspinola]

Rewritten. This PR originally also wired --require-final into the CLI. #12 landed that four minutes before this branch was pushed — written independently, converging on the same design, and #12 is the better version (it also keeps --final-cutoff accepted-and-ignored so a scheduler carrying cotdata's flag does not break, and prints a per-reference defer table). Rebased onto the new main with the duplicate dropped. What remains is the part nothing else covers.

Why

§7.1 brought the Norgate provider across from cotdata but not its tests. The suite here covers what is a pure function — _finals_ready_by_date, _check_roll_gaps, _volume_passthrough, _targets — and, since #12, the finals gate end to end. Nothing covers the code that only runs when update() drives it.

cotdata still had those tests, so the gap was invisible. It surfaced when cotdata#105 (ADR-0007 §7.5) went to delete them: that deletion is the moment these behaviours stop being tested anywhere.

A file-count check would have missed this entirely. The test files existed on both sides. Diffing the test names gave zero overlap across 30 deleted tests — which reads like a naming difference and was, underneath, a real coverage gap.

What is covered now

• reconstruction attaches its columns without disturbing front-month Volume
• First/Second are picked by volume rank, not expiry order (the GC/SI case: the nearest serial month is near-empty while a later contract carries the flow)
• an incremental run keeps rows it did not re-fetch, including ones previously recorded raw
• full=True really does bypass the trailing window — checked at the fetch, which is what proves it
• update() writes both stored tiers, from the right suffixed symbols (&ES_CCB then &ES)
• update() / update_metadata() abort before any fetch when NDU is down
• an all-null spec row is skipped rather than persisted

Two that go beyond a straight port

Both because a guard that fails open is worse than no guard:

• A raising NDU probe must read as unreachable. The guard exists because norgatedata fails in unusual ways; a probe that blows up must not be read as a pass.
• The finals gate must compare dates whatever form it is handed. Its two sides arrive as a datetime (Norgate's bar index) and a string (the store's manifest). Not a duplicate of test_cli_finals.py, which drives the gate with those already normalised.

Notes

Scoped with symbols=["ES"] against the real registry rather than a mocked all_symbols, so the tests drive the same selection path production does.

norgatedata is mocked into sys.modules, so this runs on any OS.

Verification

ruff check src tests scripts clean. MARKETDATA_NO_NETWORK=1 pytest tests/ — 152 passed, 12 skipped (141 on main + the 11 here).