Polymarket recorder deploy: block legacy uploader incompatibility

[proerror77]

Parent

#447

What to build

Make the Polymarket market-recorder deployment admission fail closed when the active market-tape uploader runtime is still a legacy Python path that cannot consume recorder outputs containing quote_collection_failure. The recorder deploy preflight/install path must verify uploader compatibility before mutating production, instead of validating only the recorder process and output freshness.

Acceptance criteria

• A focused red-capable test proves the current deploy script would accept a recorder rollout while the active uploader remains the legacy Python uploader.
• polymarket-market-recorder-deploy.sh preflight and install fail closed when the active market-tape uploader identity is not the Rust raw-ops uploader runtime.
• The compatibility check reports exact evidence for the active uploader unit, configured ExecStart, and the incompatible runtime surface it found.
• Existing recorder identity, immutable release, /proc/PID/exe, fresh output, rollback, and lock semantics remain unchanged.
• Focused tests, ShellCheck, and branch review pass.

Why now

Live ECS evidence on 2026-07-29 showed polymarket-market-tape-upload.service failing with unsupported update kind 'quote_collection_failure' while polymarket-market-tape.service remained active. The current recorder deploy contract can treat recorder rollout as healthy without proving the downstream uploader can archive the resulting segment format.

Out of scope

• Changing the legacy Python uploader implementation.
• Changing raw-ops cutover sequencing or formal Gate supervision in the same PR.
• Research/snapshot changes.

[proerror77]

Closing as mis-scoped against parent #447. Exact review of PR #481 found that requiring the Rust uploader to be active before recorder deployment reverses and deadlocks the governed raw-ops Gate/cutover sequence. Recorder deployment and raw-ops promotion remain separate rollback units; real closed-segment compatibility is proved in the raw-ops preflight instead.