Certify runtime bundles with build provenance

[MaxGhenis]

Summary

• add certified bundle metadata that records runtime model pins alongside build-time data artifact provenance
• document the staged-build versus certified-bundle release workflow
• extend release manifest tests for bundle certification fields

Testing

• PYTHONPATH=src pytest --noconftest tests/test_release_manifests.py
• ruff check src/policyengine/core/release_manifest.py src/policyengine/core/tax_benefit_model_version.py src/policyengine/core/init.py src/policyengine/tax_benefit_models/uk/model.py src/policyengine/tax_benefit_models/us/model.py tests/test_release_manifests.py
• python3 -m py_compile src/policyengine/core/release_manifest.py src/policyengine/core/tax_benefit_model_version.py src/policyengine/core/init.py src/policyengine/tax_benefit_models/uk/model.py src/policyengine/tax_benefit_models/us/model.py