Update US release bundle

[MaxGhenis]

Summary

• updates the bundled US release to policyengine-us 1.691.3 and policyengine-us-data 1.113.1
• pins US dataset, region dataset, and bundled TRO locations to the immutable HF release-manifest commit because the eCPS-only release does not have a 1.113.1 HF tag
• teaches bundle refresh/data-manifest loading to rewrite same-repo artifact revisions from package-version tags to the resolved release-manifest commit when needed

Validation

• uv run --extra dev --extra us ruff check src/policyengine/provenance/bundle.py src/policyengine/provenance/manifest.py src/policyengine/provenance/trace.py tests/test_bundle_refresh.py tests/test_release_manifests.py tests/test_trace_tro.py tests/test_us_regions.py
• uv run --extra dev --extra us pytest tests/test_release_manifests.py tests/test_bundle_refresh.py tests/test_manifest_version_mismatch.py tests/test_trace_tro.py tests/test_us_regions.py -q (104 passed)
• managed .py microsimulation smoke from published artifact:
  • dataset: hf://policyengine/policyengine-us-data/enhanced_cps_2024.h5@99e0ec7e784cdba43dd21ff1d80a081599a7a537
  • social_security: .550T
  • social_security_retirement: .179T
  • SSI: .3B
  • SNAP: .0B
  • WIC: .2B
  • EITC: .3B
  • SPM poverty: 22.68%
  • senior SPM poverty: 18.50%

Notes

The published policyengine-us-data 1.113.1 release manifest initially declares the eCPS artifact revision as 1.113.1, but HF has no 1.113.1 git tag for this eCPS-only release. This PR avoids the resulting 404 by pinning to the immutable HF commit that contains the manifest and artifacts.