Add Stage 5 release candidate validator

[anth-volk]

Fixes #1024

Summary

• Add ReleaseCandidateValidator for the 5a_validate_outputs seam, backed by the shared validation core and canonical ValidationReport/ValidationFinding output.
• Add injectable dependencies for staged artifact presence, validation report presence/status loading, release-manifest preflight, finalized release comparison, and release completion marker checks.
• Require base release artifacts alongside the regional/national H5 artifact families, and add a presence_only validation-report policy for explicit manual overrides that still require report files to exist.
• Document the Stage 5 validator seam and add unit coverage for missing artifacts, missing reports, report status/load failures, presence-only overrides, incomplete local-area prefixes, finalized releases, and finalized-marker failures.

Tests

• ruff check policyengine_us_data/release_promotion tests/unit/release_promotion
• ruff format policyengine_us_data/release_promotion/validation.py policyengine_us_data/release_promotion/__init__.py tests/unit/release_promotion/test_validation.py
• uv run --no-sync pytest -q tests/unit/release_promotion/test_validation.py
• uv run --no-sync pytest -q tests/unit/test_validation_core.py tests/unit/test_stage_contracts.py tests/unit/release_promotion/test_candidate.py tests/unit/release_promotion/test_validation.py
• uv run --no-sync --with pyyaml python scripts/run_quality_guards.py
• make lint