Safety and pause controls

Pausing increments the scope's execution generation and invalidates unsent price commands. Already-transmitted requests stay visible for reconciliation. Resuming is Admin-only and never releases old queued work.