feat(eval): unified exec-only FactorEvalRunner via factors.service (D5 C4)

[StackOverFlow11]

D5 C4 — unified exec-only FactorEvalRunner (factor data access now goes through factors.service)

Design tmp/design/factor_refactor_design_v3.md step D5 C4. The eleven per-factor eval runners keep living side-by-side (deletion is C6, gated on the C5 four-leg audit); this PR adds the unified runner and its reconciliation harness, and proves it on three factors against the frozen baselines.

What changed (4 commits)

1. qt/factor_eval_providers.py — real-cache providers: CacheMinuteProvider (promoted from factor_hotpath_smoke.py, single source, all three importers repointed), DailyEvalPanelProvider (close-view, un-lagged — the materializer applies daily_decision_lag itself), EvalServiceBundle + build_eval_service reusing qt/pipeline in the old runners' call order. Plus factors/store/incremental.py: stored-NaN→fresh-finite is now classified filled_after_footprint (was misdiagnosed as "upstream data REVISION" — the D4c footprint rows), and multi-column intermediate payloads raise the named IntermediatePayloadNotWiredError (deliberate deferral, cross-referenced in make_recompute_fn).
2. qt/factor_eval_runner.py + qt/factor_eval_disclosures.py — the unified runner: service.panel(..., view=DECISION, basis=EXEC_TO_EXEC) replaces all eleven _load_*_panel paths; heterogeneous coverage disclosures moved verbatim (8/8 VERBATIM, programmatically checked) into one home with old runners re-exporting; book_mode = decision (book via service, closing the close(d)-book live defect) or close (faithful legacy); add-Section assembly keeps mandatory sections and verdict bit-identical; new artifact stem factor_eval_* (never collides with legacy eval_*); catalogue BUG 5 (unread factors: config block → readable error) / BUG 6 (name-clash tests) / BUG 3 (PeakCoverage zero tests) closed. New CLI run-factor-eval + config/factor_eval_csi500.yaml.
3. qt/factor_eval_reconcile.py — the C5 four-leg audit harness: panels / reports / anchors modes, entry hard-gate requiring the frozen baseline 77/77 (unreachable baseline = hard error, never a skip), jump routed to the pr_c_cutoff_fix reference.
4. Harness predicates completed after the first real reconciliation failed (the harness doing its job): independent root-cause investigation found the differences are the warmup left-extension (old runners anchored at data.start with no extension, so frozen panels are under-warmed for the first w−1 trading days; the materializer left-extends toward the true cache start 2015-01-05) plus two float tails. New named, machine-checkable classes: warmup_left_extension (bounded: first w−1 days, all directions; pooled: early window + monthly non-increasing), float_reordering_tail (rel ≤ 5e-12, ≤101 cells), threshold_flip_tail (±1 count, rolling-σ noise × integer volume threshold), MD key-pairing, JSON registrations. Catalogue docs/factors/d5_runner_difference_catalogue.md gained §七之三, including a cognition correction: the handoff §3① prediction "bounded factors expect zero diff vs the D1 baseline" was wrong — the old runners' "full window" was itself anchor-truncated; that wrong prediction, not an engine bug, was the source of the first-round red.

Real-run reconciliation (cache-only, stk_mins_live_calls=0 everywhere)

Three factors × three modes, 9/9 green, zero unclassified diffs:

factor	panels	reports	anchors
minute_ideal_amp_10	warmup=8,198; unclassified=0	4/4 OK	ok=3 warmup=2 failed=0
jump_amount_corr_20	warmup=17,289; float_tail=101; unclassified=0	4/4 OK	ok=3 warmup=2 failed=0
volume_peak_count_20	warmup=34,441 (monthly 19,977→14,464 monotone ✓); threshold_flip=20; unclassified=0	4/4 OK	ok=3 warmup=2 failed=0

jump's 3 non-warmup anchor rows went green (rel ~1e-15) — the #103 cutoff fix confirmed carried by the new path.

Review

Adversarial review (separate executor): APPROVE-WITH-NITS — 0 CRIT/HIGH/MEDIUM, with 64 self-built mutation probes against the classifier classes (out-of-window diffs, over-cap tails, non-monotone monthly counts, label-only flips, reverse run-order artifact all verified to FAIL), verbatim-move rechecked 8/8, hard gate tamper-tested on a /tmp manifest copy, and an independent rerun of the minute_ideal_amp_10 panels mode matching the implementer's counts cell-for-cell. Registered non-blocking items:

• LOW-1: bounded warmup_left_extension has no magnitude/cell-count ceiling — an in-window error of arbitrary size is absorbed (~1.6% of the grid for w=20, conservative direction; pooled side has the monthly-monotonicity constraint). C5 follow-up: add a cell-count ceiling.
• LOW-2: the reports-leg digit rule is old∨new — a digit-bearing verdict.reasons line replaced by a digit-free different-meaning line still registers as warmup_aggregate_effect. Verdict labels/axes/spec/eval_config remain strict. Acceptable for C5's purpose; recorded.
• NIT-1: duplicate (date,symbol) keys crash with a raw pandas error instead of ReconciliationError (decorative; service panels cannot contain dup keys). NIT-2: the exec_price_artifact_reused reverse direction (True→False) has no pinning test (behavior verified FAIL by the reviewer's own mutation).

Gates (independently rerun by the lead)

• pytest 2492 passed (node-ID set diff: 0 pre-existing tests displaced), ruff clean
• run-phase0 demo anchor ic 0.9600 / annual 0.8408 (unchanged)
• validate-config 32/32 (new factor_eval_csi500.yaml covered by the config glob)
• secret scan: 2 benign hits — the external_secret_file path and tushare_token_key name in the new config, byte-identical in form to the 11 existing eval configs on main; no secret value anywhere
• exec_baseline_freeze --verify 77/77 @ 45c14aa; frozen panels/baselines untouched (read-only throughout)

Deliberately NOT in this PR

Old-runner deletion (C6), full 11-factor four-leg audit (C5), valley_price_quantile binding + folding binding.py into code_hash (PR-C4b, lead-adjudicated), mmp_ew (D6c), run-registry integration (D7), tail_recompute wiring for intermediate payloads (explicit named refusal, 21:00-update story).