Sync release manifest bundle versions

[anth-volk]

Fixes #336

Summary

• Sync bundled release manifest bundle_id and policyengine_version fields during release version bumps.
• Add a provenance helper so manual country bundle refreshes also preserve the current policyengine.py bundle identity.
• Update the checked-in US and UK manifest identities from 4.0.0 to 4.3.1.
• Add tests for the bump script, bundle refresh path, and bundled release manifest identity.
• Add a PR smoke workflow that copies bundled manifests into temporary sample data, applies a synthetic version update to the copies only, logs before/after state plus unified diffs, and verifies repository manifests were not modified.

Testing

• uv run ruff check .github/bump_version.py src/policyengine/provenance/bundle.py src/policyengine/provenance/__init__.py tests/test_bump_version.py tests/test_bundle_refresh.py tests/test_release_manifests.py
• uv run pytest tests/test_bump_version.py tests/test_bundle_refresh.py tests/test_release_manifests.py -q
• uv run ruff check .github/smoke_release_manifest_sync.py .github/bump_version.py
• uv run python .github/smoke_release_manifest_sync.py --target-version 9.8.7
• git diff --exit-code -- .github/bump_version.py src/policyengine/data/release_manifests