CD vintage crosswalk is an unpinned build input; July-1 release surface not reproducible

[MaxGhenis]

Problem

The July-1 sparse release (populace-us-2024-sparse-l0-refit-57k-71a0887-national-only-20260701) compiled its 32,637-target surface using --congressional-district-vintage-crosswalk cd117_to_cd119_population_crosswalk.csv. The build manifest records the file's sha256 (a615539…) but the artifact itself was never published — it lived in a since-deleted local worktree. The release's target surface is therefore not reproducible: rebuilding with the same facts and flags cannot recover the exact 117th→119th population weighting.

Sibling of #271 (Ledger facts were unversioned in the manifest; fixed by the pinned consumer artifacts) — the CD vintage crosswalk is the remaining unpinned build input.

Suggested fix

• Publish build-input artifacts like the CD vintage crosswalk alongside the release (or in a pinned artifact repo) and record repo/revision, not just sha256.
• Regenerate cd117_to_cd119_population_crosswalk.csv from Census block population data (117th→119th, 5001700US → 5001900US), validated against the per-state 119th district counts recorded in us/fiscal_target_references.json hierarchy reconciliations (CA 52, TX 38, FL 28, NY 26, …), and pin it for the corrected-release rebuild.

Found while rebuilding the corrected sparse release: the current build compiles only the 5.5k national+state surface without the flag+crosswalk pair.

[MaxGhenis]

Folded into the Build N epic (#449): the CD vintage crosswalk becomes a sha-pinned required build input as part of turning the CD target surface on (all 23,968 CD facts are 117th-vintage; crosswalk artifact + generator + conservation tests are the first Build N work item).