Harden Austrian swap-link markers

[tobomobo]

Summary

Two classes of silent-underreporting bugs surfaced by an adversarial review of the recent Austrian swap-neutrality work are addressed here.

• Tokenized marker parsing. notes marker detection switched from substring matching to exact-token matching on the documented separators ( \t\n,). Unrelated text like prefixed_at_swap_link=foo no longer flips the regime or triggers Neu swap neutrality. Duplicate/conflicting markers raise RP2ValueError instead of silently resolving to the first match.
• Cross-asset pairing validator. New AbstractCountry.validate_input_data hook (default no-op; upstream-friendly) called from rp2_main before per-asset accounting. AT overrides to run validate_at_swap_link_pairing, which asserts every at_swap_link=<id> appears on exactly one outgoing and one incoming leg across two different assets — catching the class of bug Kassiber structurally cannot catch (a leg that never made it into its input at all, e.g. partial wallet export). Events tagged at_regime=alt are skipped (Alt swaps are regime-breaking per § 27b EStG; the marker is a no-op there). rp2_main now parses every configured asset for validation, then restricts accounting/reporting to --asset if set, so narrowed diagnostic runs don't misreport valid paired swaps as orphaned.
• Same-event kind check. at_swap_link= on a non-SELL Neu disposal (GIFT/DONATE/FEE/LOST/STAKING) now raises — swap neutrality is the § 27b Abs 3 Z 2 EStG sale carveout and has no pairable incoming leg for non-sale dispositions.

AGENTS.md is updated to document tokenized matching, duplicate/conflict rejection, the SELL-only constraint, and the new pairing guarantee. The Known Gaps entry now correctly identifies basis-value verification (still trusted to Kassiber) as the remaining gap rather than basis-pairing (now enforced on RP2's side).

Test plan

• Unit tests: 237 pass (20 new, covering tokenized matching, duplicate/conflict rejection, separator coverage, non-SELL swap-link rejection, orphan/same-asset/duplicate pairing rejection, and Alt-skip semantics).
• mypy src tests clean.
• pylint -r n rated 10.00/10 on changed files.
• bandit -r src clean.
• pre-commit run passes on all changed files.
• End-to-end smoke test: rp2_at -o /tmp/... config/crypto_example.ini input/crypto_example.ods with and without -a BTC.
• Review whether the AGENTS.md update reflects the intended long-term contract before merging.

🤖 Generated with Claude Code