Add runtime metadata for bundle validation

[anth-volk]

Fixes #485

Summary

Adds a dependency-free runtime metadata emitter for policyengine-core so bundle tooling can identify the core runtime participating in a certified PolicyEngine bundle.

The new public API is:

from policyengine_core import get_runtime_metadata

It returns a JSON-compatible dictionary with installed package identity and, when available from installed PEP 610 direct URL metadata, VCS source identity:

{
  "name": "policyengine-core",
  "version": "3.25.4",
  "git_sha": "..."
}

Design notes

• Keeps policyengine-core independent from policyengine-bundles at runtime.
• Allows policyengine-bundles to own and validate the canonical schema.
• Uses installed package metadata for the version.
• Uses PEP 610 direct_url.json for VCS commit identity when available.
• Avoids local checkout Git inspection and absolute source paths so bundle metadata does not mix installed package identity with machine-local diagnostics.
• Adds a dedicated PR CI job that installs policyengine-bundles test-only and validates the emitted payload against the bundle contract.
• Pins the test-only policyengine-bundles Git dependency until that repo has published releases suitable for ordinary dependency specifiers.

Tests

• .venv/bin/python -m pytest tests/core/test_build_metadata.py
• uv run --frozen --with /Users/administrator/Documents/PolicyEngine/policyengine-bundles python -m pytest tests/core/test_build_metadata.py
• uv run --frozen ruff check policyengine_core/build_metadata.py policyengine_core/__init__.py tests/core/test_build_metadata.py
• uv run --frozen ruff format --check policyengine_core/build_metadata.py policyengine_core/__init__.py tests/core/test_build_metadata.py