Add release-backed concurrent backtest server

[luisleo526]

Summary

• replace local engine/codegen image builds with the digest-pinned pineforge-release:0.1.12 multi-arch image
• remove both Git submodules, the duplicate Dockerfile/entrypoint, and repository-root/submodule discovery
• add a FastAPI service derived from pineforge-release with bounded concurrency, bounded queueing, execution timeouts, structured phase errors, health/readiness endpoints, request IDs, and optional bearer authentication
• transpile Pine deterministically and cache compiled .so artifacts by generated C++ hash plus release/engine/toolchain identity
• deduplicate concurrent cache misses, publish cache files atomically, protect active artifacts from eviction, and enforce entry/byte limits
• add --server-url harness routing while retaining direct local release-container execution
• support an explicit rolling pineforge-release:latest channel while keeping the default pinned by semver and OCI digest
• record release identity, resolved local digest, request ID, generated C++ hash, cache key, and cache hit in report provenance
• document deployment, security controls, concurrency settings, cache persistence, and runtime channels

Why

pineforge-release already owns the combined engine and codegen runtime. Vendoring both repositories in pineforge-data made installation depend on a source checkout and forced local image builds. The API server provides a reusable runtime for concurrent harness clients, while the compile cache removes repeated g++ work without keying artifacts directly from Pine source.

Cache behavior

Every request is transpiled first. The server hashes the generated C++ and combines it with the release image, engine/codegen versions, architecture, and parity-critical compiler flags. A cache hit skips compilation and runs the cached strategy library against that request's OHLCV and parameters. Concurrent misses for one key compile exactly once.

Compatibility notes

• --image remains an alias for --runtime-image.
• --exchange remains an alias for --venue.
• the old repository-root, rebuild-image, and no-image-build options are removed because no local image is built.
• report execution sections now use the canonical release report under backtest plus a versioned runtime envelope.
• release 0.1.12 does not expose trace collection; --trace now fails explicitly.

Validation

• ruff format --check src tests
• ruff check .
• strict mypy src
• pytest (62 passed, 2 Docker-gated)
• sdist and wheel build
• direct pinned pineforge-release integration
• real derived FastAPI container with two simultaneous identical requests: one compile miss, one deduplicated hit, followed by a repeat hit (2 passed)