Add vendored bundle runtime integration

[anth-volk]

Fixes #350

Depends on PolicyEngine/policyengine-bundles#4. The policyengine-bundles PR must merge first, and the v4.4.3 bundle release assets must exist before this repo's Versioning job can publish policyengine==4.4.3.

Implements the policyengine.py side of the bundle completion plan.

Changes:

• Vendors the current bundle payload shape, including install constraints/lockfiles and validation report, so the wheel can expose a one-line constrained install helper.
• Adds pe.bundle runtime APIs and strict installed-package validation via POLICYENGINE_BUNDLE_STRICT=1.
• Adds pe.us.bundle / pe.uk.bundle and attaches bundle version/digest/profile provenance to managed microsimulations.
• Exact-pins direct PolicyEngine-owned extras from the vendored bundle.
• Adds strict bundle consistency checks to PR/release workflows.
• Updates Versioning so it downloads and vendors the matching policyengine-bundles archive before bumping pyproject.toml to the Towncrier release version.
• Updates Publish so it verifies the complete matching bundle release asset set before PyPI upload.
• Adds a post-PyPI wheel attestation asset recording the actual policyengine wheel URL and SHA256 after the wheel exists.

Release ordering:

• policyengine-bundles creates the pre-release v4.4.3 bundle without a future .py wheel hash.
• policyengine.py Versioning vendors that exact bundle and bumps to 4.4.3.
• policyengine.py Publish verifies the bundle assets, publishes the wheel, then writes policyengine-wheel-attestation-4.4.3.json to the GitHub release.

Validation:

• uv run ruff check .github tests src scripts
• uv run ruff format --check .github tests src scripts
• uv run pytest --noconftest tests/test_policyengine_bundle.py tests/test_vendor_release_bundle.py tests/test_policyengine_wheel_attestation.py tests/test_bump_version.py -q
• uv run python .github/check_bundle_consistency.py

Local limitation:

• Full repo pytest still imports shared country-package fixtures eagerly and can be slow/hang in this checkout; the new bundle-specific tests were run with --noconftest to isolate the release tooling.