refactor(risk_model): consume alpha_engine_lib.quant.factor_risk_xs (shared factor-risk engine)

[cipher813]

What

The C.2a factor-risk math (cross-sectional Fama-MacBeth Σ=B·F·Bᵀ+D builder) is lifted to the shared alpha-engine-lib (alpha_engine_lib.quant.factor_risk_xs) as the LV1-AE leverage step, so the predictor and robodashboard consume one engine. risk_model/__init__.py is now a re-export shim — training/risk_model_persist.py and all consumers keep working unchanged.

• Numerics identical — lifted verbatim (sklearn LedoitWolf preserved), so persisted F/D are unchanged.
• requirements.txt + requirements-lambda.txt: lib pin v0.42.0 → v0.47.0 (lockstep test enforces match). Root adds the [quant-xs] extra (pandas+sklearn — already predictor deps); the Lambda keeps leaner extras (inference doesn't import risk_model).
• Deleted tests/test_risk_model.py — canonical math tests now in the lib (test_quant_factor_risk_xs.py). test_risk_model_persist.py already exercises the real build_factor_risk_model through the shim end-to-end.
• Added tests/test_risk_model_lib_contract.py — consumer-contract wiring + smoke.

Verification

• Full CI suite (the --ignore test_inference/test_model set): 1359 passed, validated against an editable install of the lib branch.
• Does NOT wire portfolio_risk/tracking_error into solve_target_weights — that stays C.3-gated.

⚠️ GATED — merge order

Depends on cipher813/alpha-engine-lib#91 (adds factor_risk_xs + bumps to 0.47.0). The predictor pins the lib by git tag, so the @v0.47.0 pin resolves only after #91 merges → auto-tag creates v0.47.0. Merge #91 first, then this.

Follow-ups (filed)

• Unify the two Ledoit-Wolf impls (lib numpy factor_risk.ledoit_wolf_cov vs sklearn factor_risk_xs) — numerics-affecting, needs its own validation.
• xs-output → FactorRiskModel bridge so Option-A feeds portfolio_risk/tracking_error directly (no consumer until C.3 wiring).

🤖 Generated with Claude Code

[cipher813]

CI red here is the tag-gate, not a code defect. pip can't check out alpha-engine-lib@v0.47.0 because that tag doesn't exist yet — it's created by auto-tag when alpha-engine-lib#91 merges.

Local validation against an editable install of the lib branch is green: the CI suite (1359 tests) passes, numerics identical (sklearn LedoitWolf preserved).

Converted to draft until the gate clears:

1. Merge alpha-engine-lib#91 → v0.47.0 tag is created (+ PyPI publish).
2. Mark this ready + re-run CI (now green) → merge.