Allow offline imports with bundled data certification

[MaxGhenis]

Fixes #269.

The original issue cited a US import-time metadata lookup, but current main remaining offline import failure is the release-manifest certification fetch from Hugging Face during country model initialization. This keeps certification strict while making the unavailable-manifest path include Hugging Face transport failures.

Behavior:

• get_data_release_manifest now converts requests transport/status failures into DataReleaseManifestUnavailableError.
• certify_data_release_compatibility still only falls back to bundled certification when certified_for_model_version exactly matches the installed runtime model version.
• Existing fingerprint mismatch protection remains unchanged.

Local verification:

• Focused release-manifest/offline tests plus manifest version drift tests: 5 passed.
• Ruff check passed for src/policyengine/provenance/manifest.py and tests/test_release_manifests.py.
• Ruff format check passed for the same files.
• Forced-timeout smoke import: requests.get patched to raise Timeout, then import policyengine.tax_benefit_models.us succeeded and printed 1.687.0.