fix: inspect effective protected account selector configuration

[Pigbibi]

Changes

• Extend the existing metadata-only readiness check to inspect effective selector presence from runtime target configuration.
• Match the deployed resolver's precedence: QSL_RUNTIME_TARGET_JSON, RUNTIME_TARGET_JSON, then the direct account setting.
• Return only a nonempty flag and closed source labels; protected references remain unresolved without reading their values.
• Preserve the existing direct-setting fields, three metadata GETs and service stability checks. Reject malformed or ambiguous input with fixed reasons.

Validation

• 37 focused tests passed, including precedence, empty and null values, protected references, malformed or duplicate input, and output privacy.
• Python compilation, Ruff and diff checks passed.
• Independent scoped review identified a null-element normalization discrepancy; the correction and regression cases were verified against the deployed dependency semantics.

Runtime boundary

This changes metadata diagnosis only. It does not read secrets, invoke the broker, create or deploy services, or modify production configuration. Selector presence is distinct from verified account identity and qualified financial data.