Fingerprint canonical source OHLCV feed

[luisleo526]

Summary

• add a canonical primary-feed identity to run provenance
• hash parsed source rows in original order as domain-prefixed little-endian 5-double-plus-int64 records
• compute the hash during the existing loader pass, before validation-only slicing
• require a valid lowercase SHA-256 feed identity before building a fingerprint

Why

The same strategy/runtime could process radically different OHLCV tapes while receiving one fingerprint. A reproduced Docker collision covered 222,295 bars and 17,655 trades versus 36,361 bars and 2,917 trades with the same digest. Feed identity now separates those runs without coupling paths or CSV formatting to provenance.

Contract

feed.canonicalization is pf-ohlcv-barc-le-v1. feed.source_values_sha256 covers the prefix pineforge:ohlcv:barc-le:v1 plus NUL followed by original-order open/high/low/close/volume/timestamp records packed as little-endian 5dq. Equivalent parsed values in different paths or textual formats share an identity.

Verification

• fingerprint self-test fallback loader: 68/68
• fingerprint self-test NumPy loader: 68/68
• targeted CTest: 1/1
• Release build: passed
• full CTest: 111/111
• py_compile and git diff --check: clean
• independent cold review: GO

Deferred intentionally: ohlcv_start_ms, syminfo, loaded SO identity, volume-weighted magnifier, and output windows.