Close the NOEMP/FIRMSIZE coding-default collision before the C1/C2 freeze

[MaxGhenis]

The #195 and #204 reviews both flagged the same latent seam, neither blocking its own PR; filing it so the C1/C2 freeze checklist owns it.

banding.py's coding argument defaults to "ipums_firmsize" (banding.py:256). The per-vintage guards make NOEMP-only codes raise loudly, but three codes are valid in both code spaces and silently mis-band if a NOEMP caller omits coding:

• 2011–2018 code 4 → banded B10_49, true band B100_499
• 2011–2018 code 6 → banded B50_99, true band B500_PLUS
• 2019+ code 5 → banded B10_49/B50_99 straddle, true band B500_PLUS

Latent today because #204's reader does not call banding yet; it becomes active the moment the ASEC NOEMP output meets the target pipeline.

Two closes on the table (either satisfies both reviews):

1. Add label-verified CPS ASEC firm-size (NOEMP) reader with band-regime maps #204's reader emits CanonicalBand directly via noemp_to_canonical (the option daphnehanse11 offered on the Employer-firm Workstream B: canonical banding (C2), ADR 0003, target pipeline (#192) #195 thread), so no downstream caller ever passes raw NOEMP codes to banding — preferred.
2. Drop the coding default in banding.py so callers must state the code space.

Refs: the #195 review (approval notes, residual item) and the #204 review (approval notes). Should be closed before the joint C1/C2 freeze sign-off.

[vahid-ahmadi]

Closed in code by 85584a3 (on #195, pushed). Took option 2 from this issue: cps_firmsize_to_canonical no longer defaults coding — it is now a required keyword, so a NOEMP-holding caller can no longer silently mis-band the three dual-valid codes (4/6 in 2011–2018, 5 in 2019+). test_cps_coding_is_required pins it. The footgun is closed at the banding.py seam regardless of whether the person side later routes through noemp_to_canonical (option 1), which remains the intended C2.5 path. Closing; the C1/C2 freeze checklist can treat this residual as resolved.