Add bundle release contract artifacts

[anth-volk]

Fixes #5

Implements the bundle-repo side of the bundle completion plan and adds the pre-release bundle for policyengine==4.4.3.

Changes:

• Adds PackagePin.role, with policyengine generated as role: "bundle_carrier" so a bundle can reserve the .py version before the future .py wheel exists.
• Keeps downstream packages strict: policyengine-core, policyengine-us, and policyengine-uk still resolve from PyPI with exact versions and wheel hashes.
• Excludes bundle-carrier packages from generated constraints/lockfiles, so install targets solve downstream runtime packages only.
• Adjusts pre-release runtime validation to install constraints and verify exact downstream versions without importing the future .py wheel or country packages.
• Adds candidates/4.4.3-all.json and a fully generated bundles/4.4.3 with Python 3.13 and 3.14 install targets.
• Updates live certification CI to regenerate and compare bundles/4.4.3.
• Marks bundle GitHub releases as pre-releases and documents that the .py wheel hash is attested after policyengine.py publishes.

Validation:

• uv run ruff check .
• uv run ruff format --check .
• uv run pytest -q
• uv run python scripts/verify_bundle_digests.py
• uv run python scripts/package_bundle_release.py bundles/4.4.3 --output-dir /tmp/policyengine-bundle-4.4.3-dist
• Full live validation of bundles/4.4.3 completed locally with status=passed and metadata.validation_scope=full.