fix: cap Kalshi pagination and serialize status=all

[realfishsam]

Summary

• Cap Kalshi's default event pagination at 10 pages so the default fetch path can't bypass the safety ceiling.
• Run status=all event fetches sequentially instead of launching three concurrent paginations.

Tests

• npm test --workspace=pmxt-core -- --runInBand test/pipeline/kalshi-pagination.test.ts

Fixes #724
Fixes #725

[realfishsam]

PR Review: PASS (NOT VERIFIED)

What This Does

Caps Kalshi pagination and serializes status=all, reducing risk of unbounded pagination while preserving all-status market/event queries.

Blast Radius

Kalshi fetcher and pagination tests; affects Kalshi listing calls.
Changed files reviewed: core/src/exchanges/kalshi/fetcher.ts, core/test/pipeline/kalshi-pagination.test.ts

Consumer Verification

Before (base branch):
Base branch (origin/main) does not include these changes. I reviewed the diff against the base and did not run full live-exchange before/after reproduction in this daily batch.

After (PR branch):
PR branch build PASS; authenticated local sidecar smoke PASS using POST /api/mock/fetchMarkets with x-pmxt-access-token, response snippet: {"success":true,"data":[{"marketId":"mock-m0","eventId":"mock-event-0","title":"Which party wins the 2026 harborland election?","description":"incididunt magna metus ut cupidatat aliquip dolore quis incididunt id do aenean aenean non dolor dolore tempor pharetra lorem fugiat aenean est voluptate ...

Test Results

• Build: PASS (npm run build --workspace=pmxt-core)
• Unit tests: PASS (npm test --workspace=pmxt-core -- --runInBand)
• Server starts: PASS
• E2E smoke: PASS (POST /api/mock/fetchMarkets; live venue-specific calls were not made)
• Dependency install: skipped (existing workspace deps reused)

Findings

No blocking findings.

PMXT Pipeline Check

• Field propagation (3-layer): N/A
• OpenAPI sync: N/A
• Financial precision: OK
• Type safety: ISSUE
• Auth safety: N/A

Semver Impact

patch -- bug fix/internal compatibility change unless SDK consumers rely on newly added APIs

Risk

The branch was built, core-tested, and authenticated-smoke-tested through the sidecar. Full live-exchange before/after behavior remains unverified for this daily batch; credentialed venue calls and venue API drift should be treated as residual risk unless covered by tests in this PR.