Add per-vintage reported-coverage signal gate (#720)

[MaxGhenis]

Part of #720 (regression guard; the data-side re-extraction is tracked there and is not in this PR).

What

Adds us_reported_coverage_vintage_signal_gate (microcosm.build.us_runtime.cps_carried) and wires it into tools/build_us_fiscal_refresh_release.py: a base-frame hard gate (reported_coverage_vintage_gate, mirroring the pregnancy gate, with a persisted failure receipt before the early raise), an export-frame re-run under the #547 degraded-mode guard, and a reported_coverage_vintage_signal manifest entry.

The gate enforces the invariant the certified Build P artifact violated: every pooled source vintage — person_support_channel × source_year — must carry a fully populated, boolean column with at least one reporter for each of the nine reported-coverage person inputs (has_esi, has_marketplace_…, has_medicaid_…, has_non_marketplace_direct_purchase_…, has_champva_…, has_tricare_…, has_va_…, has_other_means_tested_…, has_indian_health_service_…_at_interview). On Build P the income-year 2022/2023 vintages had exactly zero reporters for seven of the nine (their SHA-locked inputs carry only NOW_GRP/NOW_MRK of the 18 NOW_* recodes) and _fill_health_coverage_inputs mapped NaN to False, thinning has_medicaid_health_coverage_at_interview to 24.6M under 65 against ~58M survey. Presence-style checks (release_input_coverage, degenerate_input_signal, ecps_parity) cannot see a partial-vintage hole; this gate can.

Behavior

• Groups by person_support_channel × source_year (ACS-spine rows also carry source_year, so a year-only key would let ACS signal mask a missing ASEC recode); source_year alone when no channel column exists.
• Fails closed on provenance: missing source_year column, null source years, or an empty person table fail rather than collapsing into one group.
• Per enforced group and input: boolean/numeric dtype required, zero nulls, ≥1 reporter. One failure message per (vintage, input), observational wording (14 failures on the Build P shape).
• Groups below US_REPORTED_COVERAGE_VINTAGE_GATE_MIN_ROWS (5,000 person rows — smoke pools) are recorded in details but not enforced; the rarest flag (other-means-tested, ~0.28% of persons) is expected ~14 times in 5,000 rows, so a zero at that scale is a missing-source symptom, not sampling noise.
• RED is durable: the base-frame failure writes releases/<id>/reported_coverage_vintage_gate_failure.json before raising (the receipt never marks a directory certified — CG tail transfer: field-local donor quarantine + mass-conserving own-tail stratum + E01000 receipt (#567) #568 keys on release_manifest.json), then raises as the other signal gates do.
• Ships red against the current pooled bases by design (the Build J: full eCPS-exported-column coverage as a HARD release gate + asset-column restoration (SSI reforms score $0) #368 intended-red pattern): it turns green once the 2022/2023 ASEC inputs are re-extracted with the full NOW_* coverage block (Pooled ASEC 2022/2023 vintages lack the NOW_* coverage recodes: reported Medicaid at interview thins to 24.6M vs ~58M survey under 65 on the certified artifact #720, Ingest ASEC 2024 and 2025 into the US support pool (spine is two vintages behind) #296).

Review

A cross-family adversarial review (sol) confirmed the root cause and hard-gate end state and raised five findings, all folded in here: source-family × vintage key, export-frame re-run, fail-closed provenance, completeness/dtype checks with observational failure text, and the persisted failure receipt. Its recompute also corrected two supporting claims in #720 (vintage labeling, selection direction) — see the issue comment.

Tests

• packages/microcosm-build/tests/test_us_reported_coverage_vintage_gate.py (15): contract (the nine inputs are exactly the derived health-coverage flags), pass/fail shapes including the Build P 7×2 failure shape, ASEC/ACS channel separation, sub-threshold skip, fail-closed provenance (missing/null source_year), null-value and non-boolean-dtype failures, missing column, and a mechanism test running _fill_health_coverage_inputs on NaN NOW_* source rows.
• test_us_fiscal_refresh_builder.py: _release_gate_failures includes the gate's failures with the Reported-coverage vintage signal failed: prefix; the failure receipt is written and does not make the directory look certified; the terminal-batch degraded-mode tests stub the gate like every other base-frame signal gate.

No artifacts are published or promoted by this PR.

🤖 Generated with Claude Code

[MaxGhenis]

Pushed 093daef3: the gate moved from cps_carried.py to support_provenance.py. test_us_spine_blindness requires runtime population operators to stay source-spine blind (only provenance-owner modules may read person_support_channel), and the hardened gate keys vintages by support channel — origin-aware by charter, so it belongs with the provenance owners. cps_carried.py keeps the input list, threshold, and derivation. Spine-blindness, gate, and builder suites pass locally.

Proof on real data (microcosm #720 fix, not in this PR): the source_construction stage rerun with the income-year 2022/2023 ASEC inputs augmented to the 2024 column set gives NOW_MCAID 0% null in all three vintages and the gate passes (Medicaid reporters 28,184 / 26,367 / 24,844 by vintage); the same stage on the SHA-locked inputs fails it (receipt in #720 shortly).