feat(ats): require autonomous trading policy consent

[AetherAI3]

Summary

Adds a versioned, fail-closed acceptance boundary for the Aether Agent ATS profile.

• publishes ATS_ACCEPTABLE_USE_POLICY.md v1.0.0 for autonomous trading, user-environment execution, bundled Nano strategies, browser tools, plugins, datafeeds and MCP
• requires an explicit terminal choice: 1 accepts, 2 rejects
• rejects before agent creation, storage allocation, strategy installation, datafeed/browser/plugin/MCP setup
• records a local pseudonymous receipt bound to the account scope, policy version and SHA-256
• makes the receipt explicitly non-authorizing: grants_trading_authority: false
• forces re-consent when the policy digest/version changes
• blocks non-interactive consent manufacture
• ships the policy in the npm package and updates production/release allowlists

Execution boundary

This does not redefine ATS as paper-only. Execution can occur through user-selected and user-controlled local infrastructure, accounts, credentials, brokers, plugins, browser sessions and MCP servers. Aether supplies software, strategies and agent capabilities; acceptance itself does not connect a broker or grant trading authority.

Regulatory framing

The policy avoids guaranteed-performance and misleading-AI claims, preserves non-waivable duties, and states that technology does not displace securities, commodities, supervision, privacy, sanctions, venue or market-conduct obligations. It should receive qualified counsel review before production release.

Primary context:

• SEC AI-washing enforcement: https://www.sec.gov/newsroom/press-releases/2024-36
• FINRA Regulatory Notice 24-09: https://www.finra.org/rules-guidance/notices/24-09
• CFTC AI trading-bot advisory: https://www.cftc.gov/LearnAndProtect/AdvisoriesAndArticles/AITradingBots.html

Verification

• npm run typecheck — pass
• targeted ATS/policy/REPL tests — 51/51 pass
• npm test — 2,579 pass, 0 fail, 4 platform skips
• npm run verify:production — pass; 836 packed files
• npm pack --dry-run --json --ignore-scripts — policy present
• policy digest: 30a6e043617a9089f0306a8ee4b15054d33fac296bb8c284a9ec044c98a56154