fix: clean up utcnow deprecation warnings, fix 12 failing tests, add CI/CD pipeline manifests

- Replace all datetime.utcnow() with datetime.now(tz=timezone.utc) across 8 files
- Fix 12 failing tests to match current implementation behavior
- Fix pytest_plugins in non-top-level conftest (moved to root conftest.py)
- Auto-fix 189 lint issues (import sorting, unused imports)
- Add CI/CD pipeline infrastructure (ARC, ArgoCD, Kargo manifests)
- Add values-beta.yaml and values-paper.yaml for staged deployments
- Update GitHub Actions workflow to use self-hosted-gremlin runners
- Add integration-test job to CI pipeline

Result: 1596 passed, 0 failed, 0 warnings

.kiro/specs/integration-test-pipeline/requirements.md

@@ -5,16 +5,23 @@ End-to-end integration test pipeline that runs in Kubernetes, spinning up isolat
 
 ## Functional Requirements
 
-### FR-1: Pipeline Stages
-1. **Lint** — ruff check on Python, eslint on frontend
-2. **Unit Tests** — pytest + vitest against local mocks
-3. **Build** — Docker images for all services + dashboard
-4. **Deploy Sandbox** — ephemeral namespace with own PostgreSQL, Redis, MinIO (no Ollama — too heavy for CI)
-5. **Seed Data** — populate DB and S3 with enough data to exercise every frontend component
-6. **Integration Tests** — HTTP-level validation of every API endpoint the frontend depends on
-7. **Frontend E2E** — render every page against the live sandbox APIs, assert no errors and expected data
-8. **Profiling** — measure and report timing for each pipeline stage and each API endpoint
-9. **Teardown** — delete the ephemeral namespace and all resources
+### FR-1: Integration Test Stages
+This spec covers the **integration test foundation** — sandbox infra, seed data, test suites, profiling, and a standalone runner script. A separate CI/CD pipeline spec will consume this foundation to provide build, staged promotion (beta → paper → live), market-hours gating, and break-glass deployment.
+
+Stages owned by this spec:
+1. **Deploy Sandbox** — ephemeral namespace with own PostgreSQL, Redis, MinIO (no Ollama — too heavy for CI)
+2. **Seed Data** — populate DB and S3 with enough data to exercise every frontend component
+3. **Integration Tests** — HTTP-level validation of every API endpoint the frontend depends on
+4. **Frontend Data Deps** — verify every page's API dependencies return valid data
+5. **Profiling** — measure and report timing for each stage and each API endpoint
+6. **Teardown** — delete the ephemeral namespace and all resources
+
+Stages deferred to the CI/CD pipeline spec:
+- Lint, unit tests, Docker image builds (self-hosted on gremlin nodes)
+- Staged promotion: beta → paper → live namespaces
+- Market-hours promotion blockers (no deploys during 9:30–16:00 ET unless break-glass)
+- Break-glass emergency production deploy
+- Per-stage enable/disable toggles
 
 ### FR-2: Sandbox Infrastructure
 - PostgreSQL 16 (ephemeral, no persistent volume)
@@ -72,5 +79,15 @@ Target: full pipeline completes in under 10 minutes. Seed data insertion under 3
 ### NFR-3: Reproducibility
 Seed data is deterministic (fixed UUIDs, timestamps). No external API calls (Polygon, Alpaca). All data is synthetic.
 
-### NFR-4: CI Integration
-Pipeline can be triggered from GitHub Actions as a separate workflow, or manually via `kubectl apply`.
+### NFR-4: Pipeline Integration Contract
+The runner script is a standalone tool that can be invoked by any CI/CD system. It exposes:
+- **CLI interface**: `bash infra/inttest/run_pipeline.sh [--image-tag TAG] [--namespace NAME] [--skip-teardown]`
+- **Exit codes**: 0 = all tests passed, 1 = test failures, 2 = infra setup failure
+- **JSON result file**: `inttest-results.json` with test counts, pass/fail, per-endpoint latency, stage timings
+- **stdout/stderr**: human-readable progress and summary
+
+A future CI/CD pipeline spec will invoke this script as a stage, passing in the image tag from a self-hosted build step. That spec will handle:
+- Self-hosted build runners on gremlin nodes (no GitHub Actions compute)
+- Staged promotion (beta → paper → live) with per-stage enable/disable
+- Market-hours promotion blockers (9:30–16:00 ET)
+- Break-glass emergency deploy to production