Allow explicit local dataset paths

[MaxGhenis]

Summary

• allow resolve_managed_dataset_reference to accept explicit local .h5 paths only when allow_unmanaged=True
• keep managed bundle enforcement as the default for local paths
• add release-manifest tests for rejected local paths and unmanaged local microsimulation metadata

Why

The local pipeline and long-run dataset workflows need a deliberate escape hatch for locally built datasets. Without this, local validation has to route through the bundled release manifest even when the caller explicitly wants to test a local H5.

Validation

• uv run --extra dev python -m pytest tests/test_release_manifests.py -q

[MaxGhenis]

Closing per stale-PR policy: conflicting with main for 7+ weeks. #415 stays open as the tracker — the managed-resolver surface changed since this branch, so a fresh cut is probably cheaper than a rebase.

[MaxGhenis]

Reopening pending a proper per-PR review; specific disposition to follow.

[MaxGhenis]

Closing on the merits after review: main has since gained the exact capability this branch proposed — #442 (merged 2026-06-28) added the allow_unmanaged local-path opt-in (resolve_local_managed_dataset_source; managed_microsimulation(..., allow_unmanaged=True)). Verifying that #415's specific end-to-end ask is fully covered is tracked there before that issue closes.