Fail CI on stale PolicyEngine US dependency

[MaxGhenis]

Summary

• make the PR PolicyEngine US freshness job fail instead of warn when uv.lock lags latest PyPI
• add the same blocking freshness gate to main push CI before publication candidate versioning or pipeline dispatch
• bump policyengine-us from 1.693.4 to 1.693.5 so the current main publication can launch again

Why

Latest main publication runs 26049411391 and 26051699164 failed only after merge, at the Run Pipeline dependency gate, because uv.lock still had policyengine-us 1.693.4 while PyPI latest was 1.693.5. This PR moves that failure into pre-merge PR CI and into push CI before a candidate dispatch is created.

Verification

• uv run --no-sync python .github/scripts/check_policyengine_us_dependency.py --mode fail
• uv lock --locked
• uv run --no-sync --with pyyaml python scripts/run_quality_guards.py
• workflow YAML parsed and asserted freshness dependencies
• git diff --check