Audit and gate UK formula-owned exports before publishing populace-uk

Summary

The UK side needs its own tracker for the same export-class problem found in populace-us: non-structural PolicyEngine variables with formulas can be present in a saved H5 and then act as pinned inputs. The UK audit should be aggregate-first and assertion-based; do not silently drop columns.

Local audit context

A local populace-UK candidate showed formula-marked PE-UK columns present in the saved artifact. Broad removal is not safe without classification:

• Dropping employment_income, capital_gains, or employee_pension_contributions makes those aggregates zero, so those are currently acting as source/compatibility layers rather than harmless computed outputs.
• Dropping student_loan_repayments prevents the UK simulation from building during dataset uprating.
• Several formula paths shift materially when recomputed, e.g. rail_subsidy_spending about +11%, is_married about +57%, enhanced disability flag about -88%, severe disability flag about -40% in the local one-column audit.
• Some head flags appeared aggregate-equivalent, but they still should not be auto-dropped without a declared decision.

Fix direction

• Add a PE-UK counterpart to the formula-owned export review/gate.
• The gate should assert/report formula-owned exported columns; upstream build stages must make explicit keep/drop/input-surface decisions.
• Before changing any UK formula/input surface, compare stored aggregate vs formula-recomputed aggregate and record the result.
• Distinguish true computed outputs from PE-UK compatibility/source-input formulas that may need model-side or data-side handling.
• Add regression tests so a future UK export cannot silently mutate or drop formula-owned columns.

Related: #18, #24, #25.

Review the existing populace-us formula-owned export review/gate, then read related issues #18, #24, and #25 for the UK context. Define the PE-UK audit around aggregate-first comparisons and explicit keep/drop/input-surface decisions. Done means formula-owned exports are asserted or reported, stored and recomputed aggregates are compared, and regression coverage prevents silent column mutation or removal.