fix: exclude external deposits from crypto combo performance

[Pigbibi]

Combo DCA simulations treated deposits as investment returns. Track dated external flows, calculate cashflow-adjusted TWR and performance, and report contributions, withdrawals, profit, and XIRR separately. Windowed accounting uses the actual prior equity and date. Nonconventional cashflows with multiple sign changes return an ambiguous XIRR rather than a possibly incomplete single-root result.

Preserve natural-day annualization fields, reject invalid allocation budgets, and enforce trend volatility/gross exposure caps without a 50% scaling floor. Keep scaling from increasing exposure and pass through the configured trend parameters. Default and legacy research JSON explicitly retain accounting, synthetic proxy, and unmodelled-cost status.

Add an opt-in, research-only replay entry point that calls the actual Crypto Equity Combo target builder with dated feature, universe, and benchmark snapshots. Targets use the signal-day close and known portfolio equity; holdings trade at the next natural-day open, pay explicitly assumed fees/slippage from cash, and are marked at that day's close. Reject future snapshots/state, mismatched indicator prices, unvalidated strategy data overrides, strategy fallback, missing marks, and infeasible targets. Daily and per-trade ledgers retain cash, costs, and execution dates. This entry point produces synthetic engineering evidence and does not replace the default proxy runner.

Validation: six related pytest modules passed with 75 tests and 12 subtests against the repository's exact locked QPK source; Ruff, compilation, and diff checks passed. Independent review passed, including close multiple-root, fully mocked CLI, and causal replay regressions. Independent replay checks confirmed future close-price perturbations leave initial targets/fills unchanged, caller state remains unchanged, and a hand-calculated two-period BTC buy/sell reconciles quantities, cash, both-sided fees, open gaps, and final marks.

The default altcoin curve is still a synthetic proxy with unmodelled costs. The separate actual-strategy replay uses explicit synthetic cost assumptions, not measured execution costs, and currently excludes external cashflows. Both remain ineligible for promotion or live use. Historical JSON remains unchanged and invalid for current investment-performance or promotion claims. No real-data rerun, strategy activation, dependency upgrade, production deployment, or order submission.

This is part of the 2026-10-02 compounding/Kelly audit correction series. Source and local validation are separate from dependency adoption, historical research qualification, and production acceptance. Publish for review only; merge and deployment are outside this request.