Keep PolicyEngine US fresh for data builds

[MaxGhenis]

Summary

• replace the temporary PolicyEngine US git dependency with the released exact PyPI pin policyengine-us==1.691.11
• add a CI freshness checker that warns on PRs when the locked PolicyEngine US version lags PyPI or uses a git/non-exact pin
• require the freshness checker before production pipeline and long-run projection builds, with an explicit allow_stale_policyengine_us override only for deliberate PyPI-lag cases

CRFB relevance

This prevents production H5 builds from silently using a stale PolicyEngine US runtime. It also moves data builds onto the released model containing the 2026 payroll cap and capital-gains election fixes from PolicyEngine/policyengine-us#8326. PolicyEngine US 1.691.12 is still publishing after PolicyEngine/policyengine-us#7959; if that lands before this merges, I will bump this PR once more.

Tests

• env -u UV_FROZEN uv run python .github/scripts/check_policyengine_us_dependency.py --mode fail
• env -u UV_FROZEN uv run pytest tests/unit/test_publication_scripts.py -q
• env -u UV_FROZEN uv run --no-sync --with pyyaml python scripts/run_quality_guards.py
• env -u UV_FROZEN uv lock --locked
• git diff --check