orders: assert that outside-RTH is absent when it was not asked for (ibx#352)

[userFRM]

Summary

• Every submit encoder guards tag 6433, and nothing asserted the guard. The tests checked that the flag is present when the caller set it, never that it is absent when they did not — so making all four paths emit it unconditionally failed no test at all.
• One test, both polarities, across all four paths that emit the tag: the three GTC variants and the shared extended encoder every attributed order routes through.

Why

This is the shape #247 took on the replace path, where a hard-coded 6433=1 opted every modified order into the extended session. It survived because the coverage could not express the direction it broke in — and the same blind spot is still on the submit side.

An order silently widened to outside regular hours fills at prices the caller never meant to trade at, and nothing in the callbacks distinguishes it from one they asked for.

The test reads the bytes off a socket rather than inspecting the request enum, because the enum is not where the tag is decided.

No production change: the guards were already correct. This is the assertion that keeps them so.

Closes #352.

Test plan

• cargo test --offline --lib — 803 passed. The 2 failures are config::expiry_tests::{named_zone_converts_with_dst, instant_round_trips_to_wire}, which fail on the base commit too (fixed separately in config: resolve the legacy timezone names IB states its times in (ibx#335) #336).
• cargo check --offline clean on every target: --lib, --features python, --bins, --examples, and each of the eight tests/*.rs targets individually.
• Mutation check: making all four paths emit 6433 unconditionally fails every_submit_path_emits_outside_rth_only_when_it_was_asked_for by name — and so does mutating only the shared extended encoder, so the test is not passing on the strength of one path.

🤖 Generated with Claude Code