feat(coinbase): refuse a derivative-capable account, and say what that does not prove (#666)

[eaitbrahim]

Closes #666 (Stage 1). Stage 2 — the operator attestation — is filed as #691.

Written against what a probe of the live account actually returned, not against a guess.

The probe

get_transaction_summary → margin_rate present: True, value: null
get_portfolios          → DEFAULT 'Default', CONSUMER 'My portfolio'

margin_rate is present-and-null. It's in the response schema for every account, so its presence signals nothing — a check keyed on presence would refuse every deployment, which is the exact failure this issue was filed to avoid.

A non-null value is plausibly a signal, and could not be verified — there's no margin-enabled account to compare against, so that refusal branch would ship untested. A compliance gate whose refusal path has never fired against a true positive is the gate that eventually fires on the compliant case and gets disabled in anger. It's surfaced as a warning on get_fee_summary, which already fetches that response, so visibility costs no extra request.

What is unambiguous

The portfolio list. DEFAULT and CONSUMER are the spot portfolios; INTX is the international/perpetuals one, and its presence is derivative capability on the account. verify_cash_account refuses on it, called from _build_broker beside Alpaca's — one get_portfolios read per build.

Passing means "no contradiction found", never proof

The docstring says so, and a test asserts it does, because a reader taking a pass as evidence has the guarantee backwards. Coinbase exposes no cash-versus-margin field for spot — every margin, borrow, leverage and liquidation field in its SDK lives in the futures, perpetuals or derivative-order types. Nothing here can issue a cash posture. #691 carries the attestation that can, on rail 17's pattern.

⚠️ It passes on an unreadable response — the opposite of Alpaca

A property of the venues, not an inconsistency. Alpaca fails closed because multiplier is the classification: a readable answer is definitive, so silence is a distinct third state worth refusing on.

Here the check can only refute, so silence proves nothing a readable response would also have failed to prove — and failing closed would refuse a compliant deployment on a network blip while establishing nothing. A mutation making it fail closed is one of the six killed.

The pin that fired

docs/fiqh-basis.md's open question is rewritten, and test_the_venue_boundary_premise_is_stated_not_hidden failed when this landed — which is what #672 wrote it for. It's now been re-pointed twice, and its docstring records both moves: first from a proxy that stopped tracking what it stood for, now from a premise that genuinely changed.

Verification

Tests: tests/broker_coinbase/test_adapter.py (+8), tests/commands/test_coinbase_posture_wiring.py (2, new — the call site, because three PRs this week shipped a helper whose call site was unpinned and whose removal left every other test green).

6 mutants, 6 killed: INTX no longer refusing, case-sensitive matching, the unreadable case failing closed, the margin_rate warning removed, the warning firing on null, and the build seam skipping the check.

Full suite 5268 passed / 3 skipped; ruff and mypy clean. Written test-first.