Add bundle release contract artifacts

[anth-volk]

Fixes #5

Implements the bundle-repo side of the bundle completion plan and adds the pre-release bundle for policyengine==4.4.5.

Changes:

• Adds PackagePin.role, with policyengine generated as role: "bundle_carrier" so a bundle can reserve the .py version before the future .py wheel exists.
• Keeps downstream packages strict: policyengine-core, policyengine-us, and policyengine-uk resolve from PyPI with exact versions and hashes.
• Excludes bundle-carrier packages from generated constraints/lockfiles, so install targets solve downstream runtime packages only until the .py wheel is published.
• Adds bundle digest verification, reproducible bundle archive packaging, and manual GitHub release asset publication helpers.
• Adds candidates/4.4.5-all.json and generated bundles/4.4.5 artifacts for Python 3.13 and 3.14 install targets.
• Preserves the already-merged 4.4.4 bundle from main; this PR does not attempt to recreate or own 4.4.4.
• Documents the bundle release artifact contract and the post-.py publication attestation model.

Validation:

• ruff format --check .
• ruff check .
• uv run python scripts/validate_models.py
• uv run python scripts/validate_schemas.py
• uv run python scripts/verify_bundle_digests.py
• uv run pytest

Notes:

• policyengine==4.4.5 is intentionally represented as the bundle carrier before the future .py wheel exists. The generated lockfiles therefore validate downstream runtime packages and data artifacts without installing the future .py package itself.
• Local validation skipped the future .py household smoke path for the same reason; that should be covered after the corresponding policyengine.py release exists.