Wire bounded CN index ETF research into the strategy watcher

[Pigbibi]

CN drift tasks previously stopped at diagnosis without a production caller for the bounded research and candidate workflow. Add an opt-in VPS job to the existing watcher that consumes the actual drift, fixed licensed inputs, exact installed CN/QPK/SDK revisions, and the original persistent research tickets. It uses Codex-only OIDC, admits at most one new experiment per UTC day, and reads validated forward observations before syncing a candidate for human review. Missing inputs, elapsed observation windows, unknown outcomes, and disabled configuration stop before new model or candidate writes; no live trading authority is granted.

Validation: independent review cleared; 103 tests passed in a clean environment with the exact published dependencies and blocked network, with no skips. Coverage includes the actual CN runner, SDK/service authorization, quota-deferred recovery, causal forward observations, and candidate submission recovery. Ruff, actionlint, dependency checks, and whitespace checks passed. The CN integration suite runs in an isolated environment inside the existing required test check. Real licensed market data, a forward observation producer, and a production research cycle remain unverified; the supplied policy is disabled.