Go-live gate: refuse unsafe live trading

Setting MODE=live alone no longer starts trading. check_live_ready requires an
active risk limit, MAX_POSITION_PCT < 1.0, LIVE_CONFIRMATION exactly
"I UNDERSTAND THE RISK", a minimum balance, and exchange credentials. Enforced
in Runtime.start_many (both start paths) and surfaced at GET /api/live-check;
the dashboard shows a banner and blocks the start buttons. Adds tests.

AGENTS.md

@@ -127,6 +127,15 @@ candles you control and asserts the emitted intents. See
 - Portfolio invariant: `equity = cash ± qty * mark`, realized P&L accumulates on
   close, and every order/equity point/event is persisted.
 
+## Go-live gate
+
+`app/engine/live_guard.py` (`check_live_ready`) is the single place that decides
+whether live trading may start. It is enforced in `Runtime.start_many` (so both
+the single and multi start paths are covered) and surfaced via
+`GET /api/live-check`. Never bypass it: if you add a new way to start trading,
+call `check_live_ready` first. `LIVE_CONFIRMATION` must equal
+`"I UNDERSTAND THE RISK"` — keep it a phrase, not a boolean.
+
 ## Risk controls & notifications
 
 - `app/engine/risk.py` (`RiskManager`) tracks daily loss, drawdown, position cap