Fix TRACE composition fingerprints

[anth-volk]

Fixes #547

Summary

• Recompute the US and UK composition fingerprints from the four artifact hashes recorded in each TRACE document.
• Add an offline regression test that verifies both bundled country documents.
• Run the authenticated pre-versioning TRACE comparison on same-repository pull requests.
• Preserve all individual artifact hashes, locations, model versions, and data versions.

Cause

PR #540 combined the PolicyEngine Core 3.32.10 bundle update with the 6.2.0 release commit and resolved conflicts in both TRACE documents. The bundle manifest hashes were correct, but the aggregate composition fingerprints did not equal the deterministic calculation from the recorded artifact hashes. The release workflow therefore stopped before publishing 6.2.1.

Validation

• make format
• make lint
• uv run --frozen make test — 1,190 passed, 9 skipped before the workflow-only follow-up
• uv run --frozen pytest tests/test_release_tro_generation.py tests/test_release_credentials.py -q — 56 passed after the workflow follow-up
• uv run --frozen python scripts/bundle.py check
• uv run --frozen python scripts/release_lock.py
• The public US TRACE document exactly matches regenerated output.
• GitHub Actions — all 13 checks passed, including the authenticated strict comparison of both TRACE documents.

The pull-request workflow now runs the same read-only credential validation and strict TRACE comparison as the release workflow's pre-versioning step. This checks the private UK source manifest and requires both committed TRACE documents to match the freshly generated bytes before merge.