fix: harden runtime lifecycle and explicit dispatch

[Pigbibi]

Summary

• make the live Runtime workflow explicit workflow_dispatch only
• consume and validate canonical RUNTIME_TARGET_JSON for the Binance strategy target
• record notification delivery receipts without persisting Telegram credentials or message text
• fail the runtime report when notification delivery is not acknowledged
• strengthen heartbeat and workflow-failure notification acknowledgement checks

Safety boundary

• no Runtime workflow was manually dispatched for this change
• CI/push/merge events must not trigger live execution
• production cadence remains owned by the existing Oracle/VPS external scheduler

Validation

• PYTHONPATH=. uv run pytest -q (135 passed, 4 subtests)
• uv run ruff check .
• uv lock --check
• bash tests/test_runtime_workflow_shared_config.sh
• python3 tests/test_runtime_trigger_workflow.py
• actionlint
• git diff --check origin/main...HEAD