Story: Clean up the ores.shell remnants

The shell holds no hand-written unit that generation supersedes, the three defects the clean-standard pass found are fixed rather than remembered, and every accepted exception that the menu-ownership change invalidated reads the way the code now behaves.

• The fourteen hand-written trading instrument units are gone, and every verb they answered is answered by a generated unit, or its removal is recorded with its reason.
• accounts sessions answers against the live fleet, with the parse defect fixed at its source.
• bootstrap_smoke.ores runs twice in a row without colliding on the tenants it creates.
• The hand-written accounts verbs that duplicate a capability the generated authorization menu already carries are resolved, and the decision is recorded per verb.
• The iam S01 accepted exception states what the registry now enforces, and check_registry_exceptions.py still passes.

Merged as PR #2281, with all five of its checks green. The four pieces of work the ores.shell clean-standard pass recorded rather than closed are closed: eleven hand-written trading instrument units retired behind generated ones, the session listing's parse defect fixed at its source, the bootstrap smoke recipe's precondition stated, the account-role duplication resolved per verb with the service's own generator repointed, and the iam S01 exception reason rewritten to describe what the registry enforces.

Two of the four are handled by recording rather than by a fix, and both say so where the next reader will look: four trading units need a model written before generation can supersede them, and a shell recipe cannot be idempotent while the language has no conditional and no per-command tolerance.