Add ABIDES arena

[Muhtasham]

Summary

• add an ABIDES financial-market simulation arena backed by abides-sim/abides
• pin upstream ABIDES to c4bf157678928934417aba6073eb0651aeaf6d15, constrain Python dependencies, and pin pip in the arena image
• expose a restricted CodeClash policy protocol: submitted abides_agent.py defines decide(observation) and returns declarative buy/sell limit-order intents
• add the trusted runtime adapter, starter policy, example config, arena docs, and unit coverage

Competition Format

ABIDES is an independent score-maximization arena, not direct model-vs-model trading in the same market instance.

Each CodeClash player is evaluated in an isolated ABIDES market process using matched seeds/configuration: exchange, market maker, and background zero-intelligence traders. CodeClash compares players by average trusted mark-to-market profit across those matched market runs.

This is similar in spirit to the CybORG arena format: the submitted policies do not directly mutate or inspect each other inside one shared simulator world. The competition is over who writes the better policy for the same seeded simulator conditions.

Runtime Behavior

• evaluates each CodeClash player in identical seeded ABIDES market worlds with an exchange, market maker, and background zero-intelligence traders
• compares players by average mark-to-market profit across configured market seeds
• keeps ABIDES kernel, exchange, ledgers, order books, and order construction inside trusted runtime code
• calls submitted decide(observation) code out-of-process with a per-decision timeout and passes only plain observation dictionaries
• validates and clamps returned order intents before submitting trusted ABIDES LimitOrders
• computes scores from trusted exchange ORDER_EXECUTED messages plus final exchange price, not from mutable submitted-code state
• runs each player simulation in a child process with a per-player timeout so import/runtime hangs receive CRASH_SCORE without stalling the whole round
• prepends the submitted file's parent directory during policy import so normal multi-file submissions like from helper import X work

Hardening

• replaced the native TradingAgent subclass submission contract with a restricted protocol boundary
• added validation_timeout, decision_timeout, and player_timeout config knobs
• changed missing abides_results.json handling from neutral 0.0 ties to CRASH_SCORE with error details
• uses isolated per-player worlds to avoid direct opponent-object access while keeping matched seeds/configs for fair score comparison
• retains trusted execution-ledger checks so only simulator-processed player orders affect scored cash/shares

Verification

• uv run ruff check codeclash/arenas/abides/abides.py codeclash/arenas/abides/runtime/run_abides.py tests/arenas/test_abides.py -> passed
• uv run pytest -q tests/arenas/test_abides.py -> 10 passed after final validation-timeout fix
• uv run pytest -q tests/arenas -> 195 passed during final reviewer pass
• uv run pytest -q -> 196 passed before final reviewer-pass patch; PR CI pytest is green after the final patch
• uv run pre-commit run --files codeclash/arenas/abides/abides.py codeclash/arenas/abides/runtime/run_abides.py codeclash/arenas/abides/runtime/abides_agent.py codeclash/arenas/abides/runtime/README.md tests/arenas/test_abides.py configs/examples/ABIDES__dummy__r1__s2.yaml docs/reference/arenas/abides.md -> passed
• docker build -t codeclash/abides -f codeclash/arenas/abides/ABIDES.Dockerfile . -> passed
• direct Docker runtime smoke with two starter policies:
  • both players produced per-sim status: "ok"
  • orders_submitted: 18, policy_errors: 0
  • average scores were -900.0 for both players
• full CodeClash dummy smoke: uv run python main.py configs/examples/ABIDES__dummy__r1__s2.yaml -o "$SMOKE_DIR"
  • both players passed validation
  • both rounds completed as ties
  • per-sim details included trusted ledger fields cash, shares, orders_submitted, policy_errors, and status
• adversarial direct Docker checks:
  • impossible huge quantity/price intents were clamped/bounded and produced normal finite scores/positions, not inflated profit
  • malformed decisions were logged as policy errors without crashing the round
  • infinite-loop decide() calls hit the decision timeout and did not stall the simulation
• final reviewer-pass patch: validation subprocess timeouts now invalidate the submission cleanly instead of bubbling subprocess.TimeoutExpired

Note: uv run mkdocs build --strict was previously blocked by pre-existing docs warnings about README.md/nav entries; normal docs build was already verified earlier in this PR.