Self-heal publication version sync

[anth-volk]

Fixes #1089

Summary

• emit structured data-release version state from the HF release check
• sync stale pyproject.toml versions inside the generated publication candidate flow before computing candidate scope
• keep candidate launch data-release fail-fast and make promotion fallback use the run manifest base version
• keep PR checks hard-failing on stale policyengine-us, while removing the policyengine-us freshness gates from main-push and pipeline workflows
• update the policyengine-us pin/lockfile to 1.702.1 so the PR freshness gate remains current

Validation

• uv run --no-sync --with pytest pytest tests/unit/test_publication_scripts.py
• make lint
• uv run --no-sync --with pyyaml python scripts/run_quality_guards.py
• uv run --no-sync --with pyyaml python -c 'import yaml; yaml.safe_load(open(".github/workflows/push.yaml")); yaml.safe_load(open(".github/workflows/pipeline.yaml")); print("workflow yaml parses")'
• uv run --no-sync python .github/scripts/check_policyengine_us_dependency.py --mode fail