policyengine.py updater fails when a release moves transitive pins (5.0.3: core 3.30.1, uk 2.90.2)

[MaxGhenis]

The check-policyengine-updates run for policyengine.py 5.0.3 (run 32478278649, 2026-08-21, triggered by the policyengine-release repository dispatch) failed during uv resolution, so no 5.0.3 bump PR exists:

× No solution found when resolving dependencies for split (markers: python_full_version == '3.13.*' and sys_platform == 'win32'):
╰─▶ Because policyengine-uk==2.90.2 depends on policyengine-core>=3.30.1 and your project depends on policyengine-core==3.30.0 …

Cause: the executor freezes transitive pins alongside the bundle —
projects/policyengine-simulation-executor/pyproject.toml pins policyengine==4.22.0, policyengine-core==3.30.0, policyengine-uk==2.89.2, policyengine-us==1.764.6. The updater bumps only policyengine==X, so any policyengine.py release that moves core/uk/us (5.0.3 moved to core 3.30.1 and uk 2.90.2) can no longer resolve, and the update silently stops arriving.

Consequences:

• policyengine-api's "Ensure PolicyEngine bundle is supported by simulation API" guard fails for 5.0.3 (policyengine-api#3796), because no 5.0.3 executor can be deployed.
• chore(deps): update policyengine to 5.0.2 #664 (5.0.2) still resolves because 5.0.2's pins are identical to 4.22.0's (core 3.30.0 / uk 2.89.2 / us 1.764.6).

Possible fixes: have the updater rewrite the frozen transitive pins from the released bundle's own pin set, or drop the frozen duplicates and let policyengine==X own them (they exist to make the executor's model versions explicit, so the first option preserves that intent).