alerts: require a trade setup, log every send, drop stale spread-gate vetoes, daily log rotation

Delivery-side fixes from the 2026-09-08 three-day signal-log + telegram-log
review. Nothing in the signal core changes: the 3-year H1 and M15 books at
$0.65 were regenerated before/after and are identical on every trade column
(H1 253 / +70.02R / PF 1.98, M15 1092 / +151.90R / PF 1.38); only the
exported `warnings` text differs, on 50/253 H1 and 358/1092 M15 trades.

- signal_aggregator: step 7 moves into `_attach_core_setup`; a final pass
  after the PB/CP archetypes (`_drop_stale_spread_gate_vetoes`) moves a core
  generator's "SPREAD GATE: ... costs would eat the edge" veto to
  `cleaned_warnings` whenever a later generator shipped a setup. The
  2026-09-08 07:45 UTC A-grade alert carried that line beside a $26.49 TP1;
  a fifth of H1 and a third of M15 A-grade alerts had been doing the same.
  The prefix is now the `_SPREAD_GATE_PREFIX` constant shared by both
  emitters and both cleanups.
- telegram_bot: alerts require a trade setup (`_is_alert_candidate`, shared
  by the scan and breach paths; no-setup candidates log
  `alert skipped: ... (gate reason)`). The 07:50 UTC B-grade SELL with no
  setup had gone out under the same warning.
- telegram_bot: every delivered alert / breach alert / violent-move heads-up
  logs an `... sent:` INFO line with the signal-log row id (only failures
  were logged before, so the review had to reconstruct sends from panel
  rows). Send fan-out is one `_broadcast` helper for both paths.
- telegram_bot: `telegram.log` rotates daily x 30 instead of 3-hourly x 240
  (old `_HH` files on the live box need one manual delete).
- signal_log / CLAUDE.md: `cleaned_warnings_json` is no longer a CP-only
  marker; docs say so.
- test_all: 468 tests (+2): stale-veto cleanup incl. the PB-shaped case and
  the both-vetoed case, and the alert-candidate rule with its skip line; the
  rotation test asserts MIDNIGHT / interval 86400 / 30 backups.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018xY4NPPrx6NJoG6QWHzwpd

signal_log.py

@@ -49,8 +49,11 @@ or news_engine) so this module stays at the bottom of the import graph.
 * Post-gate truth columns: ``gate_reason`` (the warning that suppressed
   the setup), ``actionable`` (grade >= C AND setup present — what an
   alert surface would act on; the ``action`` text is written BEFORE the
-  gate chain and can disagree), ``cleaned_warnings_json`` (warnings the
-  XAU_CP acceptance removed from ``warnings_json``), ``bar_range_median``
+  gate chain and can disagree), ``cleaned_warnings_json`` (warnings a
+  shipped setup superseded, removed from ``warnings_json``: the vetoes
+  the XAU_CP acceptance stripped and, since 2026-09-08, a core
+  generator's stale spread-gate veto when a later generator produced
+  the setup — so non-empty does NOT mean "XAU_CP row"), ``bar_range_median``
   (the value historically stored as ``spread`` — it is the median
   High-Low of the primary frame, NOT a broker spread), ``scan_kind``
   (``scan``; ``blocked`` for weekend/day early returns, which carry no