fix(decisions): make queue CLI cwd-independent

[saagpatel]

What

Make the documented Decision Queue V2 script entrypoint portable when invoked by absolute path from an arbitrary working directory, and add a subprocess regression that exercises that exact path.

Why

The installed portfolio-intelligence workflow invokes the canonical producer by absolute path. Python previously placed only src/ on sys.path, so from src.security_admission failed before a digest could reach the consumer.

Review Of What Was Built

• Bootstrap the repository root only for direct-file execution.
• Preserve normal package/module imports unchanged.
• Exercise a combined-security digest from an unrelated cwd in a real subprocess.

Cleanup Review

No global wrapper, dependency change, generated output, or unrelated refactor was added.

Verification Summary

• pytest tests/test_portfolio_decision_queue.py -q: 16 passed.
• ruff check .: passed.
• Absolute-path live generation from /tmp: passed.
• Same-truth baseline and candidate digests: byte-identical.
• Full local collection is environment-blocked because the available Python lacks responses; required GitHub CI remains the authoritative full-suite gate.

Shipped Summary

The branch makes the canonical producer callable exactly as documented without relying on caller cwd or an ambient PYTHONPATH.

Next Phase

Wait for required CI, address any merge-relevant failure, merge through the normal protected route, and read back remote main.

Remaining Roadmap

The installed ContractLens structural-plus-semantic canary is being verified separately; no additional GHRA scope is planned.