Add runtime metadata for bundle validation

[anth-volk]

Fixes #485

Summary

Adds a dependency-free runtime metadata emitter for policyengine-core so bundle tooling can identify the exact core runtime participating in a certified PolicyEngine bundle.

The new public API is:

from policyengine_core import get_runtime_metadata

It returns a JSON-compatible dictionary with package identity and best-effort source metadata:

{
  "name": "policyengine-core",
  "version": "3.25.4",
  "git_sha": "...",
  "source_path": "..."
}

Design notes

• Keeps policyengine-core independent from policyengine-bundles at runtime.
• Allows policyengine-bundles to own and validate the canonical schema.
• Uses installed package metadata for the version.
• Uses direct_url.json or local Git metadata for best-effort source identity.
• Includes optional contract validation when policyengine-bundles is installed in the test environment.

Tests

• .venv/bin/python -m pytest tests/core/test_build_metadata.py
• uv run --frozen ruff check policyengine_core/build_metadata.py policyengine_core/__init__.py tests/core/test_build_metadata.py
• uv run --frozen ruff format --check policyengine_core/build_metadata.py policyengine_core/__init__.py tests/core/test_build_metadata.py