Validate the Robinhood adapter's invented fixture shapes against the live venue

[eaitbrahim]

Every test in tests/broker_robinhood/ runs against a canned transport, so the suite proves the adapter is internally consistent with fixtures we wrote ourselves. Three things it cannot prove, and which only a real credential can:

1. That Robinhood accepts our Ed25519 signature at all. The signing tests verify it against our own verify-key, which is circular with respect to the venue.
2. That the endpoint paths are real. They are pinned against our reading of https://docs.robinhood.com/crypto/trading/ — and fix(brokers): close the review findings on the robinhood adapter #194 showed that reading can be wrong in both directions.
3. That the response shapes are real. tests/fixtures/rh_accounts.json's nested fee_tier_status is the load-bearing case: every number in get_fee_summary and every Preview.est_fee derives from a shape nothing outside this repo corroborates.

scripts/robinhood_smoke.py closes 1–3 with read-only GETs — no order, no money at risk. It is read-only by construction (the guard is installed onto the transport's _request, so transport-internal calls cannot route around it) and prints shapes rather than values, so balances never reach a terminal or a pasted log.

Blocked on a credential

Robinhood signs every request, including read-only ones, so ROBINHOOD_API_KEY alone cannot make a single call. Running this needs ROBINHOOD_PRIVATE_KEY — the base64 of the raw 32-byte Ed25519 seed, generated locally, never held by Robinhood. If the seed from the original credential was not kept it is unrecoverable, and a fresh keypair must be registered (invalidating the current API key).

Still not covered by this script

The order lifecycle — placement response state values, fee_charged, and whether a cancel 200 actually confirms. There is no sandbox, so that needs a real order. The lowest-risk version is a limit buy placed far below spot, polled, then cancelled: it exercises placement, get_order, and the cancel-confirmation contract while being structurally unable to fill. Tracked separately under #198.

[eaitbrahim]

PR #216 adds the script. Still blocked on ROBINHOOD_PRIVATE_KEY — the API key alone cannot sign a request.

[eaitbrahim]

Done. Ran scripts/robinhood_smoke.py against the live venue with a real credential on main (721985e): all 5 probes match their fixtures.

All three things the offline suite structurally could not prove are now closed:

1. Ed25519 signing is accepted by the venue — 10 requests, zero 401s. The circularity in the offline signing tests is gone.
2. Every endpoint path is real, including /api/v2/crypto/trading/estimated_price/ — which settles the B3 question from Robinhood adapter: close the independent review findings #196 empirically in favour of the original code.
3. Every response shape is corroborated, including fee_tier_status, the shape the feat(brokers): add the robinhood crypto v2 adapter behind the broker port #192 review called "the single most load-bearing invented shape here".

The run also found four real defects, fixed in #218 (see #217) — the blocker being that _estimated_price read a price field the venue does not send, leaving every preview unpriced. Now verified working live on both sides:

SELL 0.001 BTC -> quote=65.00137  fee=0.617513015  errors=()
BUY  0.001 BTC -> quote=64.988110 fee=0.617387045  errors=()

Still unverified, and out of scope here: the three rh_order_*.json fixtures. Order-object field names remain doc-only, because observing one requires placing a real order and there is no sandbox. Tracked under #198.