Give each country its own policyengine-core pin (#1086)

[juaristi22]

Closes #1086. This implements Max's ruling there (option 2): each country carries its own policyengine-core pin. The PR changes no engine version. The policyengine-uk bump follows in #1121, which rebases onto this PR once it merges.

Changes

• US pin. The three extras that install policyengine-us pin policyengine-core==3.32.5, the core the certified US default was built with. They are microcosm-build[us], microcosm-data[us] and microcosm-frame[policyengine].
• Conflicts. The workspace's [tool.uv] conflicts declares each of those in conflict with each extra that installs policyengine-uk: microcosm-build[uk], microcosm-data[uk] and microcosm-frame[uk], nine pairs in all. uv locks the two sides in separate forks and refuses any install that asks for both.
• Lock. Every package in uv.lock keeps its version: policyengine-core 3.32.5, policyengine-uk 2.100.0, policyengine-us 2.2.1 and spm-calculator 1.0.0. The lock gains the conflict table and per-extra markers. APPROVED_UV_LOCK_SHA256 is re-pinned for the new lock.
• Test. test_engine_core_pins.py (14 tests) reads the committed lock through uv export --frozen, which is uv's own reading of what an install gets. Every US install path resolves core 3.32.5, policyengine-us 2.2.1 and spm-calculator 1.0.0, and every US and UK combination is refused.

For developers

• One environment can no longer hold both engines: uv sync --extra us --extra uk and uv sync --all-extras are refused. CI already installs one country per job.
• The US side moves to a newer core with its next certified build. Until then, policyengine-uk bumps move only the UK side.

Testing

• The lock-level test passes on this commit alone (14 passed).
• Vahid's third review of UK: port the remaining uk-data fixes tracked in #1095, engine items included #1121, where this commit sits first, confirmed the engine versions match main's.
• CI runs every lane on this commit.

🤖 Generated with Claude Code

[vahid-ahmadi]

Automated review pass (Claude Code, high effort) — round 1 at 261bb8cd

Verdict: approve once CI finishes green. This is the #1086 ruling done as a small PR of its own, as round 3 on #1121 suggested, and it moves no engine version.

What I checked:

• No version moves. The lock still resolves policyengine-core 3.32.5, policyengine-uk 2.100.0, policyengine-us 2.2.1 and spm-calculator 1.0.0. uv lock --check is clean. APPROVED_UV_LOCK_SHA256 matches the new uv.lock (a31eb026…), and the PR sits directly on current main.
• 3.32.5 is the right US pin. It's the core named in docs/us-release-build-rule.md and the engine-lock changelog for the certified SPM 1.0 build.
• Coverage. Only microcosm-build, microcosm-data and microcosm-frame have engine extras, and no dev group installs an engine, so the nine conflict pairs are the complete set.
• The new test is useful. It fails on main, on both workspace combinations (--extra us --extra uk and --extra policyengine --extra uk), and passes here (14 passed). CI's engine-free lane picks it up.
• Probes with uv 0.12.3:
  • uv sync --all-packages --extra us --extra uk and --all-packages --all-extras are refused.
  • --all-packages --extra us and --extra uk on their own resolve.
  • CI's one-country-per-job recipes are unaffected.
• ruff check is clean.

Nits, none blocking:

1. The test only scans three packages (test_engine_core_pins.py:30, ENGINE_PACKAGES). A new package with an engine extra, or an extra that pulls an engine in through microcosm-data[uk], wouldn't join the rule.
   • Fix: read every packages/*/pyproject.toml.
   • Fix: treat a requirement on another workspace package's engine extra as installing that engine.
2. The developer docs don't mention the refusal. docs/agent-guide.md:18-20 lists the two engine environments but not that combining them now fails. One line there would save someone a confusing resolver error. packages/microcosm-data/pyproject.toml:25, "install the one(s) you load", could say one at a time too.
3. A small inaccuracy in the description. Plain uv sync --all-extras (without --all-packages) still succeeds, because the root project has no extras. The refused form is uv sync --all-packages --all-extras.

Tests run locally at 261bb8cd:

• the new pin tests: 14 passed;
• the same file against main: fails on both combination cases, as expected;
• engine-free lane (all 509 files): one failure, test_graph_orrery.py::test_public_orrery_parser_accepts_generated_document, which needs Node. My machine has none, and the same test fails identically on main, so it is environmental. Everything else passed;
• uv lock --check and ruff check .: clean.

CI at the time of review: lint, wheels, integration-uk and both engine-uk lanes pass; engine-us and engine-free were still running.

Once this lands, #1121 rebases onto it and drops its first commit.

[vahid-ahmadi]

CI is green on 261bb8cd (engine-free, engine-us and engine-uk on 3.13 and 3.14, integration-uk, lint, wheels), so this is good to merge from my side. The three nits can go in a follow-up.