Harden UK data release manifest finalization

[anth-volk]

Fixes #396

Summary

• Treat the versioned releases/<version>/release_manifest.json at the HF tag as the authoritative finalized bundle contract.
• Add strict release manifest validation for artifact hashes, sizes, defaults, build metadata, exact UK package compatibility, and exact core compatibility.
• Make finalized upload retries idempotent only when the rebuilt candidate manifest exactly matches the finalized manifest.
• Hard-fail existing tags that lack a versioned manifest or whose manifest differs from the candidate.
• Add a changelog fragment.

Testing

• python -m pytest policyengine_uk_data/tests/test_release_manifest.py -q passed locally: 22 passed, 1 skipped because policyengine-bundles is not installed locally.
• ruff check policyengine_uk_data/utils/release_manifest.py policyengine_uk_data/utils/data_upload.py policyengine_uk_data/tests/test_release_manifest.py passed.
• ruff format --check policyengine_uk_data/utils/release_manifest.py policyengine_uk_data/utils/data_upload.py policyengine_uk_data/tests/test_release_manifest.py passed.

Notes

• This intentionally does not introduce release-complete.json; the release manifest is the release contract.
• Local Python 3.14 pytest execution was blocked because this macOS x86_64 environment could not resolve a compatible torch==2.9.1 wheel through uv.