fix(tickers): close the delisting review findings

Detection could retire an actively traded symbol — silently, since it then
vanishes from every signal. Three causes:

- Form 25 is filed per security class. An issuer removing its notes, preferred
  or warrants files one while the common keeps trading. The filing's own
  descriptionClassSecurity distinguishes them, so the primary document is now
  fetched and read; anything not recognisably common equity is rejected, as is
  anything unreadable (pre-2009 filings have no primary_doc.xml). Fail closed.
- Form 15 ends a reporting obligation and is no evidence trading stopped. The
  whole family is dropped.
- A historical filing for a long-gone class could retire a symbol whose bars ran
  years later, stamping the old date. Filings before the last bar (less a 30-day
  lead for the exchange) are now ignored.

Rule 12d2-2 makes removal effective ten days after filing, so delisted_on is the
effective date rather than the filing date.

bootstrap_universe(prune_missing=True) still ran a cascading delete over
delisted rows, undoing the retention this branch exists for; it now skips them
and reports kept_delisted so the count is explicable.

clear_delisted had no route, which made "safe to automate because it is
reversible" false — reversal needed SQL. POST/DELETE /tickers/{symbol}/delisting
now mark and un-mark, giving an operator a non-destructive alternative to the
cascading DELETE that was the only option.

Shared-CIK siblings (GOOG/GOOGL) stay safe by construction: the probe is
per-symbol and gated on that symbol's own staleness, so a class that still
trades is never probed.

Not addressed: pruning a symbol merely dropped from the index still destroys its
history — the same survivorship problem in a different costume, needing a
tracked/membership state separate from delisting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/services/ticker_universe_service.py

@@ -357,9 +357,26 @@ async def bootstrap_universe(
         db.add(Ticker(symbol=symbol))
 
     deleted_count = 0
+    skipped_delisted: list[str] = []
     if symbols_to_delete:
-        result = await db.execute(delete(Ticker).where(Ticker.symbol.in_(symbols_to_delete)))
-        deleted_count = int(result.rowcount or 0)
+        # A delisted row was retained on purpose — its price history is exactly
+        # what a survivorship-honest backtest needs, and the delete cascades it
+        # away. Pruning must not undo that. (Pruning a symbol that is merely no
+        # longer an index constituent still destroys history; that needs a
+        # tracked/membership state separate from delisting.)
+        protected = (
+            await db.execute(
+                select(Ticker.symbol).where(
+                    Ticker.symbol.in_(symbols_to_delete),
+                    Ticker.delisted_on.is_not(None),
+                )
+            )
+        ).scalars().all()
+        skipped_delisted = sorted(protected)
+        deletable = [s for s in symbols_to_delete if s not in set(protected)]
+        if deletable:
+            result = await db.execute(delete(Ticker).where(Ticker.symbol.in_(deletable)))
+            deleted_count = int(result.rowcount or 0)
 
     await db.commit()
 
@@ -378,4 +395,8 @@ async def bootstrap_universe(
         "already_tracked": len(target_symbols & existing_symbols),
         "deleted": deleted_count,
         "added_symbols": symbols_to_add[:50],
+        # Delisted rows a prune declined to destroy, so the caller can see the
+        # count did not match what they asked to remove.
+        "kept_delisted": skipped_delisted[:50],
+        "kept_delisted_count": len(skipped_delisted),
     }