Refresh UK release bundle and require targeted bundle validation

[anth-volk]

Problem

The bundled UK release manifest needs to move to the latest policyengine-uk release while preserving the certified policyengine-uk-data artifact currently used by policyengine.py.

During local refresh work, broad pytest collection proved too slow and a local TRO regeneration initially dropped the data_release_manifest artifact when private data-manifest access was unavailable. That failure mode should be caught explicitly by AI/release-bundle guidance.

Proposed work

• Refresh the bundled UK release manifest to policyengine-uk==2.88.40 while preserving policyengine-uk-data==1.55.10.
• Mark certification as legacy_compatible_model_package because the data artifact was built with policyengine-uk==2.88.20 but is certified for 2.88.40.
• Update manifest/model metadata tests.
• Add a targeted bundle validator for future bundle refreshes.
• Update AI-facing release-bundle guidance to require the validator and to stop when TRO regeneration drops data_release_manifest.

Validation expected

• Targeted UK bundle validator passes for the refreshed model/data pair.
• New validator script passes Ruff.
• Existing focused manifest/model metadata checks are updated to match the refreshed bundle.