P0: require service identity to match runtime target mode

[Pigbibi]

Finding

Runtime identity must be derived from the signed runtime target rather than an inherited or legacy service name. A service with a paper-oriented identity must not carry a live execution target without an explicit, audited identity migration.

Required guard

• Validate service identity, target execution mode, strategy profile, and dry-run setting together before scheduler enablement.
• Require an explicit migration record for any legacy service-name/mode mismatch.
• Treat a mismatch as a canary/admission blocker, not as a reason to infer or rewrite the strategy.
• Surface only non-sensitive identity/status fields in the unified management console.

Acceptance evidence

• Unit coverage for mismatch rejection.
• Deployment preflight output records the signed target identity.
• Scheduler enablement is blocked until the migration record is present.

[Pigbibi]

Resolution: the service name denotes the broker Paper account. In the shared runtime schema, execution_mode=live means the program may submit orders; it does not identify a real-money broker account. The Paper-vs-live broker identity is supplied by the account configuration. The target was restored to its valid submit-enabled mode, with paper credentials retained. Follow-up belongs in unified UI labels (broker account type vs submission permission), not a service-name/mode rejection rule.