Use bundle-certified dataset materialization

[anth-volk]

Fixes #502

Summary

• expose one public materialize_dataset dispatcher that returns the selected source URI, local file path, logical name, and optional bundle provenance
• route its three outcomes through _use_bundle_dataset, _download_hugging_face_dataset, and _use_local_dataset; none of the private outcome functions uses “materialize” in its name
• for bundle-managed inputs, read the repository ID, repository type, artifact path, immutable revision, and SHA-256 directly from the release bundle, supporting both policyengine-*-data and Populace artifacts without package-name dispatch
• reuse a bundle destination file only when its SHA-256 matches; otherwise download to a temporary file, verify it, and atomically replace the destination; apply the same operation to an optional metadata file
• for explicit Hugging Face inputs, retry against a dataset repository only after a model-repository 404; report authentication and authorization errors directly
• pass explicit local paths through unchanged; both explicit Hugging Face and local inputs require allow_unmanaged=True
• replace the duplicated source-selection branches in the US and UK dataset creators and managed simulation constructors with one dispatcher call
• record the selected data package, repository type, revision, source URI, local path, and verified SHA-256 with managed simulations
• remove the standalone explicit-Hugging-Face downloader module, obsolete managed-dataset GCS code, implicit sibling-repository discovery, package strategy classes, duplicate hashing helpers, and cache-status output; UK geography asset handling remains unchanged
• update documentation, package contents, changelog fragments, and tests for the reduced API

Verification

• uv run make lint: passed
• uv run make test: 803 passed with 86% statement coverage
• focused dataset, runtime, release-manifest, long-term, and bundle tests: 96 passed
• public materialize_dataset import check: passed
• uv lock --check, dependency compatibility, and bundle metadata checks: passed
• wheel and source archive builds: passed; the deleted downloader module is absent

The full test suite used local and mocked data only; live private-dataset integration was not run because this environment does not have an authorized Hugging Face token. The repository-wide mypy command is not currently a passing local project check: its configuration specifies unsupported Python 3.9 and it reports existing errors across unrelated modules.