Add Zenodo preservation mirroring for certified releases

[MaxGhenis]

Fixes #404
Addresses #439 (code half; DOI recording is per-release ops).

Provenance of the port

Supersedes closed PR #405 (branch zenodo-mirroring, kept for cherry-pick) after its full merits review. The deposit core transfers essentially verbatim — the Zenodo deposition flow, the hardened licence gate (refusing private and gated/unverifiable Hugging Face repos), the metadata builder, and the mocked test harness. The models it depends on (PreservationMirror, preservation_mirrors, preservation_dois, canonical_json_bytes) are all intact on main.

What the bundle-metadata migration (#425/#427/#438) invalidated in #405, and how this PR retargets it:

• Dead data/release_manifests/ path. _bundled_tro_bytes() now reads the shipped TRO from data/bundle/{country}.trace.tro.jsonld (where scripts/generate_trace_tros.py writes it via BUNDLE_TRO_DIR). That directory was deleted by the migration, so Zenodo mirroring for certified releases #405's module would have raised for every country at runtime.
• repo_type passthrough. Both _dataset_location_from_uri(...) calls now pass repo_type=country_manifest.data_package.repo_type instead of relying on the removed "model" default. This is load-bearing: the certified US artifact's data_package.repo_type is dataset, so the old default would have produced a wrong (non-/datasets/) Hugging Face URL.
• Rewritten CLI/trace surfaces. cli.py gained a bundle command group and restructured dispatch since Zenodo mirroring for certified releases #405's June base, so zenodo-mirror is registered in the current _parser() and dispatched in the current main(). The pe:preservationDoi hook in trace.py's build_trace_tro_from_release_bundle (whose signature also changed) is re-placed by hand, emitting DataReleaseManifest.preservation_dois on the performance node. The old release-manifest pathway is not restored (explicit Surface UK Populace Zenodo DOI in bundle provenance #439 requirement).

Tests

All Zenodo/HF interaction is mocked — no live calls, no ZENODO_TOKEN use anywhere.

• tests/test_zenodo_mirror.py — 15 tests: deposit flow, draft-vs-publish DOI recording, per-mirror sha256 integrity, sandbox targeting, the metadata builder, and the licence gate (private, gated-but-HTTP-200, transient-unverifiable, and public-repo dataset inclusion). The shipped-bytes assertion is fixed to data/bundle/.
• tests/test_trace_tro.py — 2 added tests for pe:preservationDoi: omitted when the release records no DOI, and surfaced on the performance node when the data release manifest carries one.
• Local run of the three affected files — 70 passed (test_zenodo_mirror.py 15, test_trace_tro.py 46, test_preservation_mirror.py 9).
• ruff format --check . and ruff check . clean. mypy src/policyengine/provenance/zenodo.py introduces no new error category — its 4 findings are the same house-style call-arg / import-untyped / no-any-return patterns already present in sibling provenance/ modules (e.g. verify.py, certification.py), and the two retarget edits add none.

Out of scope (per-release ops after merge, tracked on #439)

• Live deposits and recording the current build's concept DOI into the live data release manifests' preservation_dois are per-release operations performed after merge. The deposited TRO binds the manifest, so the DOI lives on the consuming side, not inside the snapshot.
• The stale June concept DOIs from Zenodo mirroring for certified releases #405's live deposits (10.5281/zenodo.2067851x) describe builds that main has since superseded; they are not embedded anywhere in this PR. The DOI-surfacing test uses a synthetic placeholder value.

🤖 Generated with Claude Code