Preserve PUF detail and harden eCPS gates

[MaxGhenis]

Summary

• preserves PUF-support clone tax/detail and overlap variables when collapsing back to the CPS scaffold, with source-row ids so shuffled clone rows cannot be copied positionally
• reconciles key income identities after clone collapse for interest, dividends, private pensions, and unemployment
• hardens mp300k eCPS-comparison gates so the frozen production-eCPS certificate must match the benchmark manifest on certificate type, period, baseline H5 sha, target DB sha, PE-US-data commit, policyengine-us version, target profile/scope/count/list hash, and scoring config hash

Context

This is independent of the larger chained-microimpute migration Claude is prototyping. It closes two promotion-safety gaps found during the rollback review: PUF clone collapse could still discard or misalign donor detail, and the frozen baseline gate did not yet enforce the full scorer/target-surface fingerprint.

Checks

• uv run --python 3.13 --extra dev --with pydantic --with-editable ../microplex pytest -q tests/pipelines/test_mp_benchmark_manifest.py tests/pipelines/test_mp300k_artifact_gates.py tests/pipelines/test_mp300k_gate_inputs.py tests/pipelines/test_ecps_replacement_comparison.py
• uv run --python 3.13 --extra dev --with pydantic --with-editable ../microplex pytest -q tests/pipelines/test_us.py -k puf_support_clone
• uv run --python 3.13 --extra dev --with ruff ruff format ... --check
• uv run --python 3.13 --extra dev --with ruff ruff check ...