fix: clean up utcnow deprecation warnings, fix 12 failing tests, add CI/CD pipeline manifests

- Replace all datetime.utcnow() with datetime.now(tz=timezone.utc) across 8 files
- Fix 12 failing tests to match current implementation behavior
- Fix pytest_plugins in non-top-level conftest (moved to root conftest.py)
- Auto-fix 189 lint issues (import sorting, unused imports)
- Add CI/CD pipeline infrastructure (ARC, ArgoCD, Kargo manifests)
- Add values-beta.yaml and values-paper.yaml for staged deployments
- Update GitHub Actions workflow to use self-hosted-gremlin runners
- Add integration-test job to CI pipeline

Result: 1596 passed, 0 failed, 0 warnings

docs/LOCAL_DEV_SETUP.md

@@ -373,6 +373,110 @@ All services read configuration from environment variables with sensible default
 
 ---
 
+## 11. Integration Tests
+
+The integration test pipeline validates all API endpoints against a live Kubernetes sandbox with realistic seed data. It deploys ephemeral infrastructure (PostgreSQL, Redis, MinIO), seeds deterministic test data, deploys all API services, and runs the full test suite with profiling.
+
+### Prerequisites
+
+- `kubectl` configured with access to a Kubernetes cluster
+- Docker images built and pushed to GHCR (or use `:latest`)
+- `envsubst` available (usually part of `gettext` package)
+- `GHCR_TOKEN` environment variable set for image pulls (optional if images are public)
+
+### Running the Full Pipeline
+
+```bash
+# Run with latest images
+bash infra/inttest/run_pipeline.sh
+
+# Run with a specific image tag
+bash infra/inttest/run_pipeline.sh --image-tag abc123
+
+# Keep the sandbox running for debugging
+bash infra/inttest/run_pipeline.sh --skip-teardown
+
+# Custom namespace and results file
+bash infra/inttest/run_pipeline.sh --namespace my-test --results-file results.json
+```
+
+### CLI Options
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `--image-tag TAG` | `latest` | Docker image tag to deploy |
+| `--namespace NAME` | `stonks-inttest-<timestamp>` | Kubernetes namespace name |
+| `--skip-teardown` | `false` | Leave namespace running after tests |
+| `--results-file PATH` | `inttest-results.json` | Path for JSON results output |
+
+### Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | All tests passed |
+| 1 | One or more test failures |
+| 2 | Infrastructure setup failure |
+
+### JSON Result Contract
+
+The pipeline produces a JSON results file (`inttest-results.json` by default) with this structure:
+
+```json
+{
+  "run_id": "stonks-inttest-1705312800",
+  "image_tag": "abc123",
+  "started_at": "2025-01-15T12:00:00Z",
+  "completed_at": "2025-01-15T12:07:30Z",
+  "exit_code": 0,
+  "stages": {
+    "infra_deploy": {"duration_s": 45, "status": "ok"},
+    "seed_data": {"duration_s": 8, "status": "ok"},
+    "service_deploy": {"duration_s": 32, "status": "ok"},
+    "integration_tests": {"duration_s": 28, "status": "ok"},
+    "teardown": {"duration_s": 5, "status": "ok"}
+  },
+  "tests": {"total": 41, "passed": 41, "failed": 0, "errors": 0},
+  "profiling": {
+    "endpoints": {"/api/companies": {"p50_ms": 12, "p95_ms": 25, "p99_ms": 45}},
+    "slow_endpoints": []
+  }
+}
+```
+
+### Running Tests Locally (Development)
+
+For faster iteration during development, you can run individual test files against local services:
+
+```bash
+# Start local services first (query-api on 8000, registry on 8001, etc.)
+# Then run specific test files:
+.venv/bin/python -m pytest tests/integration/test_query_api.py -v --tb=short
+.venv/bin/python -m pytest tests/integration/test_registry_api.py -v --tb=short
+.venv/bin/python -m pytest tests/integration/test_frontend_data_deps.py -v --tb=short
+
+# Run with profiling output:
+.venv/bin/python -m pytest tests/integration/ -v --profiling-output=profiling.json
+```
+
+Set the service URLs via environment variables:
+```bash
+export QUERY_API_URL=http://localhost:8000
+export REGISTRY_API_URL=http://localhost:8001
+export RISK_API_URL=http://localhost:8002
+export TRADING_API_URL=http://localhost:8003
+```
+
+### Future: CI/CD Pipeline
+
+This integration test runner is designed as a standalone foundation. A future CI/CD pipeline spec will consume it as one stage in a larger pipeline that includes:
+- Self-hosted builds on gremlin nodes (no GitHub Actions compute costs)
+- Staged promotion: beta → paper → live
+- Market-hours promotion blockers (9:30–16:00 ET)
+- Break-glass emergency deploy to production
+- Per-stage enable/disable toggles
+
+---
+
 ## Troubleshooting
 
 ### "Connection refused" to PostgreSQL/Redis/MinIO