Support helper-local var state in request.security

[luisleo526]

Summary

• support scalar helper-local var state while lowering user-defined functions inside request.security
• preserve requested-context rollback across provisional child evaluations
• infer only the supported two-numeric-element tuple shape and fail closed on unsupported tuple or series bindings
• compose helper-bound OHLC history offsets consistently between declaration collection and emission
• reject varip, conditional persistent state, and nested stateful calls from once-only var initializers until their execution boundaries can be preserved

Campaign result

The private target standard/officialjackofalltrades-concordance-execution-model-joat moves from a transpile error to exact 946/946 Excellent parity with zero price, entry, exit, or PnL error.

Validation

• full Python suite: pass (1549 passed, 2 skipped before the final fence; final rerun exit 0)
• focused helper-state tests: pass, including compile/runtime rollback and negative control-flow fences
• opt-in compile corpus: 254/254 pass
• committed impact scan: 418 private strategies, exactly Concordance changes; the other 417 outputs are byte-identical
• engine corpus impact scan: 254/254 valid on both revisions with zero generated-output changes
• final impact manifest SHA-256: 396d51f7b5046f49919c2d22a4ad7e1ce0d5dee7c9e4cb4dd4b7690f6fe997f4
• independent cold review: CLEAN after three discovered execution-boundary/history issues were fenced and regression-tested