market: emit FIFA 17's own forSale itemState, not the oracle's listFS

Single-field protocol-correctness fix, deployed as a candidate for a live A/B.

`itemData.itemState: "listFS"` on the seller's own auction rows is not a FIFA 17
token at all: zero occurrences in `CardsDLL_Win64_retail.dll` (md5
4de3493131d7d2ff7f8b360c5ac9b655), zero in 4.26 GiB of live client memory, and it
decodes to -1 through `FUN_180166660` — so the client was handed an unrecognised
`CARD_OFFERSTATE`. FIFA 17's value for an item offered for sale is `forSale` (5),
from the 12-row table at 0x180229cc0.

Changed only where the invalid token was emitted: `handle_market_query`
(GET …/tradePile) and `handle_market_status` (GET …/trade/status). The market
search path already emitted `forSale` and is untouched — which is also why the
risk here was lower than it looked: the client has been decoding `forSale` on a
live route all along, and only the seller's own pile carried the bad value.

Wire A/B on the same expired row: EXACTLY one field differs. tradeId, tradeState,
expires, startingBid, buyNowPrice, currentBid, bidState, sellerName,
sellerEstablished, watched, coinsProcessed, the twelve-atom count and the whole
itemData card are byte-identical; coins unchanged at 29,843,976; Fix A's zero
`inactive` rows intact.

The differential asserted PARITY on this field and therefore passed while BOTH
sides were wrong — the exact mechanism by which the defect survived every run.
`market query tradePile` is now DIFFERENT-BY-DESIGN, pinning oracle == "listFS"
and rust == "forSale" so the divergence cannot silently close again. Where the
FIFA 17 binary contradicts the Python oracle, the binary wins.

Gates: 126 host tests, 214 adapter tests, fmt clean, clippy clean.

NOT claimed: that this preserves the list -> expire -> Return-to-Club lifecycle.
That needs an operator FIFA 17 session and has NOT been observed yet. Also not
claimed: anything about the Flash action gate — `CARD_OFFERSTATE` is one of three
still-confounded candidates and this change does not test it. Revert is one line
if the live test fails.

openfut-utas-host/src/market.rs

@@ -79,9 +79,14 @@ fn trade_id_from_path(path: &str) -> Option<String> {
 /// snapshot persisted at listing time; a row written before snapshots existed
 /// degrades to the stub (honest, not fabricated).
 ///
-/// `item_state` overrides the card's `itemState`: the seller's own pile uses
-/// `listFS` (list-for-sale), market search results use `forSale` — the oracle
-/// distinguishes these, so the caller passes the one its screen needs.
+/// `item_state` overrides the card's `itemState`. FIFA 17's vocabulary is the
+/// 12-row `{const char*, int}` table at `0x180229cc0`, and `forSale` (5) is its
+/// value for an item offered for sale. The Python oracle stamps `listFS` on the
+/// seller's own pile instead — a token that does NOT EXIST in FIFA 17 (zero
+/// occurrences in `CardsDLL_Win64_retail.dll`, zero in 4.26 GiB of live process
+/// memory) and therefore decodes to `-1` through `FUN_180166660`, i.e. the client
+/// is handed an unrecognised `CARD_OFFERSTATE`. Where the binary contradicts the
+/// oracle, the binary wins.
 fn auction_record_as(l: &Listing, item_state: &str) -> Value {
     let trade_id: i64 = l.listing_id.parse().unwrap_or(0);
     // resourceId is the FIFA wire identity the client listed (never the Core
@@ -380,9 +385,9 @@ pub async fn handle_market_list(
 /// Query listings in a given `state` (e.g. the user's own sale pile is the
 /// `active` set). Returns the oracle's tradePile shape.
 ///
-/// This is the SELLER's own pile, so each card carries `itemState: "listFS"`
-/// (list-for-sale) — the state the oracle stamps on a tradePile card, distinct
-/// from the `forSale` used for market search results.
+/// Each card carries `itemState: "forSale"` (5) — FIFA 17's own token for an item
+/// offered for sale. The oracle's `listFS` is not a FIFA 17 value at all and
+/// decoded to `-1`; see [`auction_record_as`].
 ///
 /// ONLY real auctions appear here. An item sitting in the trade pile with no
 /// auction is deliberately absent: `plan-2026-08-06-transfer-market.md:731-733`
@@ -406,7 +411,7 @@ pub async fn handle_market_query(
     };
     let auctions: Vec<Value> = listings
         .iter()
-        .map(|l| auction_record_as(l, "listFS"))
+        .map(|l| auction_record_as(l, "forSale"))
         .collect();
     // GetTradePile shares one deserializer (0x18013e7f0) with ISSearch and
     // ISWatchList, over exactly four members: `auctionInfo` (array), `credits`
@@ -495,7 +500,7 @@ pub async fn handle_market_status(
     };
     let auctions: Vec<Value> = listings
         .iter()
-        .map(|l| auction_record_as(l, "listFS"))
+        .map(|l| auction_record_as(l, "forSale"))
         .collect();
     eprintln!(
         "utas-host owner=RUST route=market-status requested={} returned={} query={}",
@@ -989,10 +994,14 @@ mod tests {
         assert_eq!(snap["rating"], 84);
         assert_eq!(snap["preferredPosition"], "ST");
         assert_eq!(snap["attributeList"].as_array().unwrap().len(), 6);
-        // tradePile embeds that full card and stamps the seller-pile state.
+        // tradePile embeds that full card and stamps the seller-pile state. This
+        // asserted `listFS` until FIFA17.exe disproved it: that token appears
+        // nowhere in CardsDLL or in 4.26 GiB of live process memory and decoded to
+        // -1, so the client was handed an unrecognised CARD_OFFERSTATE. `forSale`
+        // (5) is the value in FIFA 17's own itemState table.
         let pile = handle_market_query("active", &econ, &store).await;
         let rec = parse(&pile)["auctionInfo"][0].clone();
-        assert_eq!(rec["itemData"]["itemState"], "listFS");
+        assert_eq!(rec["itemData"]["itemState"], "forSale");
         assert_eq!(rec["itemData"]["rating"], 84);
         assert_eq!(rec["itemData"]["id"], 100004617i64);
         assert_eq!(rec["itemData"]["resourceId"], 169193);