Foresixa read-only feed diagnostic

This is a one-shot REST diagnostic, not a production core or WebSocket stream.
It reads a paper account and separate crypto quotes for BTC/USD and ETH/USD.
The official Alpaca crypto quote endpoint is on data.alpaca.markets, separate
from the paper account endpoint. All HTTP requests use GET with redirects blocked.

Extract the complete package together. Python 3, POSIX (Linux/macOS), no pip
dependencies required. Worker configuration and private credentials are separate.

worker_config.json contains nonsecret declarations. stream_feed labels are
never used as evidence. The verifier does not update configuration or ledgers.

Privately create credentials.env on your host with exactly these names:
ALPACA_BASE_URL=https://paper-api.alpaca.markets
ALPACA_PAPER_KEY=<fresh paper key entered privately>
ALPACA_PAPER_SECRET=<fresh paper secret entered privately>
Replace the placeholders privately. Do not copy live credentials into paper names.
The credential file must be owned by your user, have one hard link, not be a
symlink, and be restricted to mode 600. Never share it or include it in a package.

Run from the extracted directory:
python3 verify_live_feeds.py --config worker_config.json --credentials-file credentials.env

For another location, pass its actual path with --credentials-file. Do not use an
example /absolute/path unless you actually created a file there. With no flags,
the config and credential defaults are beside the script. For already-loaded
paper environment variables, use --environment-only instead of --credentials-file.

Output distinguishes ACCOUNT_READ_AUTHENTICATED from FRESH_REST_QUOTES_VERIFIED.
Quote validation requires every requested symbol, positive finite bid/ask,
bid <= ask, timezone-aware provider timestamps no older than 60 seconds and
no more than 5 seconds ahead of the host clock. Keep the host clock synchronized.
Stale, missing, malformed or rejected data remains unverified; no fallback prices.

Futures remains FUTURES_FEED_UNCONFIGURED. /MES is a symbolic declaration, not
a provider-specific expiring contract subscription. The $5 per index point per
contract multiplier does not create a futures data adapter or market entitlement.
Configuration cannot assert a connection or enable orders. A genuine futures
provider adapter, credentials/entitlements, contract mapping and fresh observations
are still needed. This module does not implement that missing provider.

Exit 1 means multi-worker verification is incomplete, including the expected
PARTIAL_CHECKS_PASSED_FUTURES_UNCONFIGURED state when account and crypto pass.
stream_verified remains false because no WebSocket streaming is tested.
No orders, trial, funding, risk changes, production or real-money clearance.
Credential revocation/rotation cannot be established by an authenticated read.

Local tests:
python3 -m unittest discover -s tests -p 'test_live_feeds.py' -v

Only share sanitized diagnostic output, never credentials or raw network logs.