Add a curated New Zealand bundle suite (--suite nz)

[MaxGhenis]

Adds --suite nz to chronicle build-bundle: a curated roster of every New Zealand source package, guarded against alias drift the way the UK suite is. Microcosm's NZ graph will pin the consumer artifact built from it, as the UK graph pins build-bundle --suite uk -> build-consumer-artifact. Package G8-c of microcosm#1183.

What changes

1. The NZ roster (chronicle/bundle.py).
   • Adds NZ_BUNDLE_SOURCE_PREFIXES (ird, mbie, msd, stats_nz, treasury) and a sorted NZ_BUNDLE_SOURCES.
   • Adds nz_bundle_sources_from_aliases() and assert_nz_bundle_sources_match_aliases().
   • The roster has 48 packages: IRD 3, MBIE 1, MSD 4, Stats NZ 38 and Treasury 2. Stats NZ includes all 36 Census 2023 Place Summaries members from Add Stats NZ 2023 Census household and family counts by regional council #335: two national roots, plus rc_01–rc_09, rc_12–rc_18 and rc_99 for each.
   • No package under those prefixes belongs to another country, so the prefix rule needs no exception list.
2. Dispatch (chronicle/harness.py). build_bundle_dir and the CLI accept --suite nz and refuse it together with --source, as uk does. The UK error text is unchanged, and a test pins it.
3. Treasury storage prefix (chronicle/artifacts.py). The "nz" publisher set lacked treasury, so Chronicle computed raw/treasury/... keys. The two NZ Treasury manifests declare raw/nz/treasury/.... Adding treasury makes the computed keys match those declarations, which verify-raw otherwise rejects; it also affects derived/nz.
4. One --year builds every member. All 48 packages pin their artifact year and have no year-dependent declarations. The pins are 2019 ×1, 2023 ×36, 2024 ×3, 2025 ×2 and 2026 ×6. Each package's published reference periods are preserved. This is documented in the suite's docstring, the README and the harness doc, and a test guards it.
5. Docs: the README and docs/agent-source-package-harness.md, plus two changelog fragments.

Tests

On the final tree, after merging main (which brought #338's recursive discovery):

• tests/test_source_package_alias_drift.py: 28 passed;
• tests/test_chronicle_artifacts.py: 39 passed;
• tests/test_chronicle_bundle.py: 24 passed. The full-bundle node is deselected and left to CI.

What the new tests check:

• the roster equals the NZ-prefixed aliases;
• adding or dropping an alias fails the guard;
• all 36 Census members are present;
• the roster covers every package directory on disk;
• the UK and NZ rosters are disjoint;
• --suite nz with --source is refused, and the CLI accepts both suites;
• the Treasury manifests' canonical keys.

Mutants, each failing the named tests:

• dropping one Census rc_XX member;
• adding a UK package to the roster;
• letting --suite nz accept --source;
• making the NZ drift assertion a no-op.

End-to-end build

The hub ran the real build once at 351d0b7b, through this branch's code under the machine's heavy-run lock: build-bundle --suite nz, then build-consumer-artifact from its output.

• build-bundle: exit 0, 54 s. 48 source packages, 0 skipped, 12,089 facts.
• build-consumer-artifact: exit 0, 5 s. The manifest reads:
  • schema_version: policyengine_ledger.consumer_artifact.v2;
  • consumer_fact_schema_versions: [chronicle.consumer_fact.v4];
  • consumer_fact_schema_sha256: cc9efb90…, the same as the UK feed's;
  • fact_row_count: 12089;
  • facts_sha256: a132629e43ab32e857b50446a9adeb3b2fdc6230f7d663b2097732f2e94913bb;
  • the manifest file's own SHA-256: 2d82bc552914b54d36b4c84cc6265c17d1de71c2bc738381b9eda08c963095cb.

These hashes describe this branch, not merged main. G8-f rebuilds from the merged commit and pins that artifact.

Review

An independent GPT-6.1 Sol review at 351d0b7b returned APPROVE_WITH_NITS:

• 91 tests passed; 12 mutants were detected; all 24 added or changed test cases were shown to fail under mutation.
• It checked: exactly 48 NZ packages, including the 36 Census members; no overlap with the UK suite; published periods unchanged across six probe years; UK behaviour and error text unchanged.
• Only four Treasury keys move. An offline verify-raw turns their four key_mismatch results into verified.

Its one gap, that a completed end-to-end build couldn't be verified in its sandbox, is answered by the build above. It marked "Needs Max: yes" because the README and changelog describe suite coverage and storage routing. That is documentation of a CLI option and a storage path, not a published figure, so the hub treats it as no. This follows #336, where a developer-tool changelog line was treated the same way.

How it was built

• An Opus lane wrote the implementation and was stopped by its account's weekly limit while running mutants.
• A GPT-6.1 Sol lane audited it file by file, corrected the documentation and test names, and re-ran the tests and mutants.
• The hub committed the work, merged main, and re-ran the three test files.

🤖 Generated with Claude Code

[MaxGhenis]

Merged by the NZ hub (session local_e407a527) at 351d0b7 with --merge. Gates: gh pr checks exit 0; MERGEABLE; not draft; no CHANGES_REQUESTED review. Reviewed head: 351d0b7. Independent GPT-6.1 Sol review at 351d0b7: APPROVE_WITH_NITS. 91 tests, 12 mutants detected, all 24 added/changed cases shown red; 48-member roster, UK unchanged, only four Treasury keys move. Its Needs Max: yes concerned README/changelog wording about suite coverage and storage routing; the hub treats tool documentation as not a published claim (precedent #336). Its verification gap (no end-to-end build) is answered by the hub's real build at 351d0b7: 48 packages, 0 skipped, 12,089 facts, consumer artifact facts_sha256 a132629e. Report: ~/reviews/nz-hub/jobs/review-chronicle-340/.