feat(signal): publish finalized adjusted-daily snapshots

[gregkonush]

Summary

• add a separately deployable Effect 4 Signal publisher with daily and bounded historical modes
• publish immutable consolidated-SIP adjusted-bar and exchange-session rows, verify exact replicated readback, and append the manifest last
• require every configured symbol on every exchange session before finalization; no incomplete historical session can be hidden
• emit the exact 64-hex content-addressed snapshot identity required by Bayn's finalized-snapshot contract
• bound current-session historical queries outside Alpaca's 15-minute Basic-plan delay window
• remove provider credentials, DDL, and the legacy backfill command from Bayn
• add a controller-validated sealed credential, least-privilege GitOps, OCI build and promotion workflows, contract tests, and an operating runbook
• preserve a passed Agent smoke result if only post-test Kind teardown wedges; functional resource cleanup still runs explicitly

Related Issues

PROOMPT-357

Testing

• bun run --filter @proompteng/signal-publisher test: 18 passed / 75 assertions
• bun run --filter @proompteng/signal-publisher tsc
• bun run --filter @proompteng/signal-publisher lint
• bun run --filter @proompteng/signal-publisher lint:oxlint
• bun run --filter @proompteng/signal-publisher lint:oxlint:type
• bun run --filter @proompteng/signal-publisher build
• bun test packages/scripts/src/signal/gitops-contract.test.ts: 3 passed / 16 assertions
• bun run --filter @proompteng/bayn test: 43 passed
• bun run --filter @proompteng/bayn tsc
• bun run --filter @proompteng/bayn lint and typed lint
• kubeseal --validate against the live controller
• full kustomize build --enable-helm argocd/applications/torghut: 98 rendered resources
• bun run lint:argocd: zero invalid resources
• multi-platform Nix image builds passed for linux/amd64 and linux/arm64
• live read-only Alpaca comparison for SPY on 2026-07-17 proved SIP access and materially different coverage: IEX 2,010,179 volume / 26,655 trades; SIP 62,723,008 volume / 735,287 trades
• live read-only full-universe dry run for 2017-01-01 through 2026-07-17 returned 2,397 exchange sessions and exactly 19,176 SIP bars across DBC/EEM/EFA/GLD/IEF/SPY/TLT/VNQ, with zero missing or unexpected symbol-session rows
• live read-only ClickHouse checks confirmed Decimal64 fixed-scale serialization, exact system type names, two replicas, and support for the configured quorum and sequential-consistency settings

Rollout

• The new tables are additive and the publisher CronJob remains suspended until immutable image promotion.
• The sealed credential is scoped to torghut/signal-publisher-clickhouse-auth; the ClickHouse principal receives only SELECT, INSERT on the three new tables.
• Publisher inserts require both ClickHouse replicas; publication fails closed if quorum or sequential readback is unavailable.
• The ClickHouse operator may roll its two replicas sequentially when the new user configuration is reconciled.
• Completion still requires immutable image promotion and two distinct scheduled publication observations after rollout.

Breaking Changes

The operator-only Bayn backfill command is removed. The legacy adjusted_daily_bars_v1 table remains intact and Bayn continues reading it until PROOMPT-360 adopts the bounded snapshot reader.

Checklist

• Testing section documents the exact validation performed.
• Screenshots are not applicable; Breaking Changes is filled in.
• Documentation, rollout impact, rollback, authority, and follow-up observation gates are documented.

[linear-code]

PROOMPT-357

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0501b66961

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".