Add Ledger governance and raw fact boundary checks

[MaxGhenis]

Summary

• rename the Arch package, tests, CLI, schemas, docs, DB/mirror naming, Supabase schema defaults, and source-package namespaces to Ledger
• remove legacy Arch env/consumer-contract aliases and make ledger the only CLI entry point
• define Ledger as the government-statistics release layer: source artifacts, source-backed facts, provenance, normalization, and target profiles
• remove raw microdata and solver/calibration surfaces from the Ledger package, including micro/, calibration/, ledger.microdata, policyengine_ledger.microdata, raw CPS/PUF/FRS adapters, tracked raw storage/, and obsolete tests/docs
• remove legacy microplex, policyengine-us, scipy, and related simulator/calibration dependency paths from package metadata and lockfile
• reject runtime-like target profile hooks such as runtime_code, python_code, solver, module, command, and execute, including nested profile contracts
• clarify target profile docs as source/profile metadata only, not executable bindings or solver instructions
• update CI to lint/test the current source-only Ledger surface and smoke-test the wheel without microdata imports
• refresh fixtures and bundle expectations for the current expanded default Ledger source surface
• keep policyengine_ledger wrapper imports aligned with the renamed ledger package
• merge latest origin/main after the repo rename and convert the newly added ONS/HMRC UK firm source packages to Ledger schema/raw-evidence conventions

Verification

• uv run ruff format --check ledger policyengine_ledger db scripts tests
• uv run ruff check ledger policyengine_ledger db scripts tests
• uv run ruff format --check policyengine_ledger/target_profiles/model.py tests/test_policyengine_ledger_target_profiles.py
• uv run ruff check policyengine_ledger/target_profiles/model.py tests/test_policyengine_ledger_target_profiles.py
• uv run ruff format --check policyengine_ledger/target_profiles/model.py policyengine_ledger/targets/__init__.py
• uv run ruff check policyengine_ledger/target_profiles/model.py policyengine_ledger/targets/__init__.py
• git diff --check and git diff --cached --check
• uv run pytest tests/test_ledger_governance.py tests/test_ledger_namespace.py tests/test_policyengine_ledger_imports.py tests/test_ledger_boundaries.py tests/test_ledger_core.py tests/test_supabase_client.py -q — 30 passed, 1 skipped
• uv run pytest tests/test_policyengine_ledger_target_profiles.py tests/test_ledger_governance.py tests/test_ledger_boundaries.py -q — 23 passed
• uv run pytest tests/test_policyengine_ledger_target_profiles.py tests/test_ledger_boundaries.py -q — 21 passed
• PYTHONDONTWRITEBYTECODE=1 uv run pytest -p no:cacheprovider tests/test_policyengine_ledger_target_profiles.py tests/test_ledger_boundaries.py tests/test_policyengine_ledger_imports.py -q — 27 passed after deleting tracked raw storage/
• uv run pytest -q — 511 passed, 1 skipped, 14 warnings
• uv build
• wheel install/import smoke in a clean /tmp/ledger-wheel-smoke Python 3.14 venv
• env -u UV_FROZEN uv lock
• rg -n "microplex|Microplex|MICROPLEX" . -g "!*.pyc" — no matches
• checked micro/, calibration/, storage/, ledger/microdata/, and policyengine_ledger/microdata/ are absent from the checkout after cleanup
• local boundary sweep found no Microplex references and only expected runtime/executable hits in the explicit forbidden-key list / no-runtime docstring

Review

• ran /cycle read-only review on the rename/boundary work; first pass found stale Arch wording in packaged docstrings/comments, fixed it, and the latest pass reported no actionable findings.
• fresh raw-microdata removal review found stale scipy, policyengine-us, and downstream compiler-plan remnants; all three were fixed in 076b107.
• follow-up review found runtime-hook and downstream-plan wording gaps; fixed in 9d63eab and 8fc59c4.
• final follow-up review after e6f1acf found no actionable findings; it confirmed storage/pu2023_slim.csv is gone, no tracked raw-data namespaces remain, Microplex references are absent, and runtime-like profile keys are recursively forbidden.