Stamp saved US simulation outputs with the rename register they were calculated under #592

Follow-up to #532 / #590, which left saved simulation outputs out of scope.

Problem

MicrosimulationModelVersion.load() (src/policyengine/tax_benefit_models/common/model_version.py) refuses a saved US output only when it has no renames record (legacy_inputs.RENAMES_H5_DATASET, written by PolicyEngineUSDataset.save()). save() likewise requires only that record. The record shows that an output was calculated with the legacy-input mapping, not under which register. The comment on RENAMES_H5_DATASET and docs/microsim.md both say so.

When legacy_inputs.LEGACY_INPUT_RENAMES gains, loses or retargets an entry, outputs saved before the change still carry a record. Simulation.load() and Simulation.ensure() then reuse them. An output calculated before an entry was registered can lack that input, as outputs calculated before the WIC entry gave every WIC-eligible person WIC (PolicyEngine/microcosm#1026). #590 closed the same gap for create_datasets year files with an exact-match stamp (YEAR_FILE_STAMP_H5_DATASET, year_file_stamp_problem).

There is a second gap. A run over a year file maps nothing for renames that the year file already stores under the live name. So the output depends on the register the year file was cut under, and on its format revision, as well as on the register at run time. Nothing in the output records that. An output calculated from a year file opened directly (PolicyEngineUSDataset(filepath=...), which load_datasets would have refused) is reused after ensure_datasets cuts that year file again. The same happens after a year-file format revision is raised, for example when the temporary ACS WIC assumption is removed (#563).

Proposal

• When a US run is calculated, record a stamp in the output's metadata. The stamp holds the whole register, an output format revision and the year-file stamp of the input dataset (null when the input carries none). PolicyEngineUSDataset.load() and create_datasets() keep a year file's stamp in the dataset's metadata so the run can see it.
• save() writes that stamp last, under its own H5 dataset name (policyengine_output_stamp, distinct from policyengine_year_file_stamp, and with a different key set), so an output never passes as a year file or the reverse, and a save that stops part-way leaves no stamp.
• load() raises unless the stamp matches exactly: the same output revision and register, a year-file stamp that is null or this release's, and a renames record within the stamped register. Simulation.ensure() already runs again on any load error. The reason names the renames the output may lack, from the register alone, with no WIC special case.

Out of scope: storage_id is not content-addressed and carries no model or data version (#455), and source dataset identity (dataset_logical_name drops @revision).