Add reusable typed model artifacts and transfer graphs

[MaxGhenis]

Fitted models can now be declared, verified graph dependencies and reused across separate populations. A donor-only QRF training node produces one typed model artifact; independent application nodes consume it with entity-keyed draws. The two-destination example runs the real fitter, monetary conversion and Adam calibration, then evaluates consumption against separate synthetic references.

The graph extension includes type and cycle validation, immutable artifact contexts, cache integrity and resume checks, numeric compatibility refusal, portable manifest provenance, and gate ancestry. Legacy declarations retain their keys and serialized shape. Typed cache records use schema 2 and typed manifests use schema 3. Interface amendment 19 and the updated lock are included for owner review.

Training and application adapters have separate source identities. The public stateless QRF method preserves the existing predict() RNG path; zero-weight donor rows are excluded only in the new training kernel. QRF's implementing source changed, so its parity identity pins were refreshed after exact native direct-output comparison; existing measured Linux output fixtures were retained. Country bundle, loader and compiler-inventory hashes also attest those source bytes and were refreshed after checking the original source against their previous hashes. Regenerating the current US compiler-coverage report changes only eight hash leaves; configuration, ownership and schedules remain unchanged.

Validation: 507 graph/fit/transfer tests passed, 2 skipped, against actual installed wheels with isolated imports. All six shard wheels built. With locked country engines installed, 40 loader/country/seed/US-adapter tests and 21 inventory/coverage tests pass. The coverage generator's freshness check passes all 42,154 configuration fields and 41 inventory checks. Ruff, formatting for changed files, CI inventory and interface checks passed. Independent implementation review covered graph, fit and transfer boundaries; the source-identity coupling finding was fixed and regression-tested.

GitHub CI passed at ee617ea672a7a81b4a86b3c03091a29f084682d4: all 23 checks are green, including the US/UK/shared engine matrices, both installed-wheel suites and the aggregate gate.

These are synthetic engineering integrations. The mortality/ageing consumer is in dependent PR PolicyEngine/microcosm-dynamics#420, pinned to implementation commit 3ff92b0aea14407d09479bff5623dc7d1a92d008; subsequent core commits refresh source-derived test and compiler attestations. This PR does not change production country drivers or certify a population release.