Warn on unknown keys beside values: in parameter YAML

[MaxGhenis]

Fixes #505.

Problem

The parameter loader accepted allowed_keys in _validate_parameter but never enforced it, so an unknown key placed beside values: was silently discarded. The most damaging instance is an uprating: block written as a sibling of values: instead of under metadata:: the file looks like it uprates, loads cleanly, and passes CI, while the parameter freezes at its last explicit value (documented across ~25 policyengine-us files in PolicyEngine/policyengine-us#8905).

Change

Reinstates unknown-key validation as a warning (not an error), per the issue's warn-in-minor / error-in-major rollout:

• New ParameterKeyWarning (in policyengine_core.warnings).
• _validate_parameter now flags any key outside the node's allowed set, naming the file, the offending key, and the fix (Move upratingundermetadata:.).
• Applies wherever allowed_keys is already passed: top-level parameters, breakdown children, scale nodes, scale-bracket component leaves, index files, and value-at-instant nodes.
• Scale brackets now recognize the common description/metadata/documentation keys in addition to their tax components, so bracket-level metadata (used to route uprating, see Scale parameter thresholds don't support uprating #390) does not warn.
• reference and unit remain recognized as backward-compatible legacy keys (LEGACY_COMPAT_KEYS) so existing correctly- and legacy-authored files do not emit noise.

Real-world validation

Loading the full policyengine-us parameter tree with this change emits 96 warnings, each a real latent bug: 95 misplaced uprating blocks (matching the ~103 nodes in policyengine-us#8905) plus one refrence typo that was being silently dropped. Correctly-placed reference/unit/uprating (under metadata:) produce zero warnings.

Tests

• New tests/core/parameter_validation/test_unknown_keys.py (9 tests): a sibling uprating: triggers the warning naming file/key/fix; a metadata-nested uprating: does not; scale-level, bracket-level, and bracket-component-leaf cases covered; a fully valid parameter emits nothing.
• Fixtures unknown_key_beside_values.yaml (warns) and uprating_under_metadata.yaml (does not).

Checks run

• uv run pytest tests -m "not smoke" → 595 passed, 1 skipped, 1 xfailed.
• policyengine-core test on the bundled country template → 39 passed, no key warnings.
• ruff format (clean) and ruff check (passed).
• Not run: the -m smoke suite (requires network / GitHub microdata token).

🤖 Generated with Claude Code

[MaxGhenis]

Fable review: the enforcement gap was real (allowed_keys accepted but never checked since the OpenFisca port); warn-mode per #505's rollout plan, with the legacy reference/unit carve-out and bracket common-keys expansion preventing false positives — validated against the full policyengine-us tree (96 warnings, all true positives including a silently-dropped refrence typo, zero false). 595 tests + 39 country-template green.