Full eCPS input-column coverage as a HARD release gate + reform-coverage smoke (#368 Deliverable 1)

[MaxGhenis]

Deliverable 1 of #368 — the HARD coverage gate

Closes Deliverable 1 of #368. This makes full eCPS input-column coverage a hard
release gate and wires the reform-coverage smoke into the release tool.

This gate is RED on today's artifacts by design — that is the deliverable, not
a regression. Per Max's order, the three SSI countable-resource asset inputs
(bank_account_assets, stock_assets, bond_assets) ship as hard requirements
with no reviewed exclusion. They are currently absent from the export, so
both the column gate and the SSI reform probe fail on the current dense and
sparse defaults. Deliverable 2 (porting the SCF asset stage) restores them and
turns the gate green. A gate that fails the current default is the point: it is
exactly the check that would have blocked the certification where an SSI
asset-limit reform ($10k/$20k) scored $0.

What this adds

• Column-coverage contract. A versioned in-repo manifest declares every
  input column the pinned reference eCPS populates (158 layers): 58 required
  • 100 reviewed_exclusion (each with a reason and tracking issue). The gate
    fails a required column that is absent OR present-but-degenerate (every value
    the engine default), and — with Gate releases on input columns stuck at the engine default #286 cannot-rot semantics — a reviewed
    exclusion whose column has caught up. It generalizes the Carry SNAP eligibility and exemption inputs through Populace US outputs #350 mechanism
    (assert_required_us_release_source_columns, 5 columns) to the whole surface.
• Release-tool wiring. tools/build_us_fiscal_refresh_release.py runs the
  manifest anti-rot preflight before calibration, the column gate on the
  calibrated export before write_dataset, and the reform-coverage smoke on the
  written H5 — on both the dense and sparse default paths, aborting the
  release like the export-mass parity gate. Each writes a JSON artifact
  (input_coverage.json, reform_coverage_smoke.json).
• Reform-coverage smoke. A pinned bound reform that scores ~$0 fails the
  release. First probe: SSI asset limits $10k/$20k (dense-native reference
  +$1.6B; no-limit ≈ +$16.1B, Sparse-57k certified release drops SSI asset input columns; SSI resource-test reforms score $0 on bundle 4.18.8 #356). It binds only through the SSI asset leaves,
  so it is $0 while they are absent.
• Manifest anti-rot. assert_release_input_coverage_manifest_current proves
  the declared surface equals the reference eCPS populated layers, keeps the SSI
  assets as hard requirements, and (against the live engine, when available)
  checks every declared column is a real PE-US input leaf.

Tests

test_release_input_coverage.py covers the five brief cases (full-set pass,
missing-column fail, degenerate-without-exclusion fail, stale-exclusion fail,
$0-bound-reform smoke fail) plus red-by-design guards (SSI assets stay required;
demoting one is rejected) and a generator/​manifest sync guard — all isolated
from policyengine-us via a real Frame, a stub engine, an injected simulate,
and a monkeypatched reform builder.

CI safety

CI runs the test suite (uv run pytest) and lint (uv run ruff check .), not
releases — so this gate does not block CI; it blocks the release build. The
tests validate the gate logic without policyengine-us. This PR also fixes a
live-tree-guard break the prior manifest commit introduced (its reference
field named the retired data package).

Refs: #340, #356, #361, #278, #350 (mechanism), #286 (cannot-rot), #323, #359,
policyengine.py#463.

🤖 Generated with Claude Code