Add raw Pine Docker backtest harness

[luisleo526]

What changed

• accept raw PineScript v6 through pineforge-backtest --pine
• pin pineforge-codegen-oss and pineforge-engine as public HTTPS submodules
• build a local Docker image from those exact pins and the harness source digest
• transpile with the Python codegen, compile generated C++, and execute the engine entirely inside Docker
• keep provider fetching/normalization on the host and mount only temporary inputs read-only
• reserve cpp/providers as the native provider bucket
• add a Docker integration CI job and raw-Pine fixture

Why

Users should not need to transpile Pine manually, install a host C++ toolchain, or provide a platform-specific strategy shared library. Raw Pine plus provider parameters should be the public backtest interface, with Docker as the reproducible native boundary.

User impact

After cloning with submodules and installing the Python package, users can run:

pineforge-backtest --pine strategy.pine --exchange kraken --symbol BTC/USD \
  --timeframe 15m --start 2026-07-07T00:00:00Z --end 2026-07-08T00:00:00Z

The first run builds the pin-addressed local image. Reports include Pine/generated-C++ hashes, exact data-image/codegen/engine provenance, compile timing, trades, metrics, and equity.

The runtime container is non-root, network-disabled, capability-free, no-new-privileges, and read-only apart from an executable temporary filesystem required to load the generated strategy library.

Validation

• Ruff
• strict mypy
• 32 unit tests, 1 Docker integration test opt-in
• wheel and sdist build
• Docker image build on arm64
• deterministic raw-Pine Docker integration fixture
• live CCXT/Kraken raw-Pine run: 96/96 bars processed, 10 trades