fix: accept QSP PRESENT prices status

[Pigbibi]

Summary

• Accept the canonical QSP inputs.prices contract exactly: {status, format, sha256, size_bytes} with status=PRESENT.
• Add fail-closed regressions for missing status, non-PRESENT status, and extra keys before compute/output.

Tests-first evidence

• RED: producer-faithful fixtures with status=PRESENT failed against the old consumer with T2B2_PRESENT_INVALID.
• GREEN: UV_PROJECT_ENVIRONMENT=/tmp/uesp-t2b3-present-status-consumer-fix-20260722-venv uv run --frozen pytest -q tests/test_tqqq_local_no_order_runner.py — 18 passed.
• Provider-free private artifact validation: package and manifest were re-hashed to their expected SHA-256 values; the immutable package/bundle validator passes without provider acquisition.

Scope and validation

• Exact tracked scope: 2 files only (tqqq_local_no_order_present.py, test_tqqq_local_no_order_runner.py).
• Changed-file Ruff, compileall, uv build, git diff --check, and sensitive-diff scan pass.

Unchanged baseline failures

• Full pytest has 11 existing collection errors on both exact d4cd5123026b488530a38f7e7dc723d4cfd375bb and this head; base/candidate delta introduced no new fingerprint.
• Full Ruff has 33 existing errors on both exact base and this head; base/candidate delta introduced no new fingerprint.

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: No issues found

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a63ef08596

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".