Publish per-package consumer artifacts

[juaristi22]

Summary

• Build hash-pinned consumer artifacts directly from one public Chronicle package.
• Record package, source, source-commit, access, row-count, and content identities in the manifest, then publish the verified two-file artifact at a content-addressed R2 key.
• Reject licensed and restricted package publication, document the workflow, and verify the first HMRC and DfE packages contain 126 and 770 facts respectively.

Testing

• uv run --locked pytest -q — 748 passed, 1 skipped.
• uv run --locked --with ruff ruff format --check on all modified Python files.
• uv run --locked --with ruff ruff check on all modified Python files.

Fixes #230