Preserve set_input values across apply_reform

[MaxGhenis]

Summary

Closes #473 (remaining piece), fixes PolicyEngine/policyengine.py#1628, unblocks PolicyEngine/policyengine-us#8058.

Two related bugs prevent country packages that build a situation/dataset then apply a structural reform during Simulation.__init__ (the policyengine-uk and policyengine-us pattern) from working under core 3.24.x. Plus a latent bug in GroupPopulation.clone that surfaced while wiring up the fix.

The problem

Wipe bug. The H3 fix (#463) added _invalidate_all_caches to wipe holder._memory_storage._arrays for every variable after apply_reform, so formula output caches couldn't survive a reform that invalidated them. But user-provided set_input values share the same storage, so they got wiped too. Surfaced as policyengine-uk household-impact tests returning 0 because age, employment_income, would_claim_* were wiped before any calculation ran (#1628).

Nested-branch fallback bug. The C1 fix (#457) correctly stopped Holder.get_array from returning values stored under an arbitrary sibling branch — that had caused silent reform↔baseline cross-contamination. But it only fell back to the default branch, which broke nested-branch patterns. policyengine-us uses a two-level pattern: tax_liability_if_itemizing sets tax_unit_itemizes=True on an itemizing branch, and ctc_limiting_tax_liability forks a no_salt sub-branch from it. Without parent-branch fallback, tax_unit_itemizes re-runs its formula on no_salt, which calls tax_liability_if_itemizing again, producing an infinite recursion (surfaced as RecursionError and a CycleError).

Latent GroupPopulation.clone bug. GroupPopulation.clone called holder.clone(self) — passing the source population rather than the cloned population. Holder.clone then set new_dict["simulation"] = population.simulation, pointing the cloned holder's .simulation back at the original simulation. Branch-aware lookups therefore started from the wrong simulation.

Fixes

1. Simulation._invalidate_all_caches preserves user inputs. Track every (variable, branch, period) populated via Simulation.set_input OR Holder.set_input (the latter covers the Simulation(situation=...) path through SimulationBuilder.finalize_variables_init). On invalidation: snapshot those entries, wipe everything, replay the snapshotted inputs back. Formula-output caches are still invalidated; user inputs survive.

2. Holder.get_array walks simulation.parent_branch. Walk up the parent-branch chain before falling back to default. Sibling branches (no parent relationship) still don't leak into each other — the C1 guarantee holds.

3. GroupPopulation.clone passes the cloned population to holders. holder.clone(result) instead of holder.clone(self).

The _user_input_keys attribute is lazy-initialised inside both Simulation.set_input and Holder.set_input so country-package subclasses that bypass super().__init__ (same pattern _fast_cache was guarded for in #474) automatically pick up the preservation without downstream code changes.

Tests

tests/core/test_apply_reform_preserves_user_inputs.py:

• a set_input value survives a no-op reform
• multiple set_input values across different variables all survive
• a situation-dict input survives a reform (covers the holder.set_input path via SimulationBuilder.finalize_variables_init, not just Simulation.set_input)
• the H3 fix (formula cache invalidation) still holds — neutralize_variable still drops the cached formula output

tests/core/test_holder_branch_fallback.py:

• (pre-existing) sibling-branch cross-contamination stays blocked
• (pre-existing) fallback to the default branch still works
• new: get_array on a nested branch walks parent_branch and returns the ancestor's value
• new: GroupPopulation.clone points each holder's .simulation at the clone, not the source

All three existing test_fast_cache_guards.py tests (bare-Simulation case) still pass because of the hasattr-gated lazy init.

End-to-end verification

Installing this branch into a policyengine.py checkout with policyengine-uk==2.88.0:

Test	Before	After
test_single_adult_with_employment_income (income_tax > 0)	0.0 (FAIL)	£7,486 ✓
test_single_adult_with_employment_income (NI > 0)	0.0 (FAIL)	£2,994 ✓
test_family_with_children (child_benefit > 0)	0.0 (FAIL)	£2,328 ✓

Installing this branch into a policyengine-us==1.647.0 checkout (core 3.24.1 floor):

• tax_unit_itemizes.yaml integration test that crashed with TypeError: int() argument ... not 'NoneType' → 7/7 pass.

Test plan

• tests/core/test_apply_reform_preserves_user_inputs.py — 4/4 pass
• tests/core/test_holder_branch_fallback.py — 4/4 pass
• tests/core/test_apply_reform_invalidates_cache.py (H3 regression) — 1/1 still passes
• tests/core/test_fast_cache_guards.py — 3/3 still pass
• tests/core/ full suite — 514/515 pass (1 pre-existing test_parameter_security failure unrelated to these changes)
• uvx ruff format --check / uvx ruff check clean
• End-to-end with policyengine-uk 2.88.0 + policyengine.py: failing household-impact tests now pass
• End-to-end with policyengine-us 1.647.0: tax_unit_itemizes.yaml passes
• CI passes