Guard PUF support clone top tail

[MaxGhenis]

Summary

• add a PUF support-clone top-tail guard that caps unsupported clone rough AGI just below the open-ended $79M SOI bin
• compute the cap trigger on a nonredundant rough-AGI basis, avoiding double-counting derived totals and their leaves
• scale PUF-imputed investment/top-tail variables proportionally and record before/after diagnostics in the support-clone summary
• cover enabled/disabled guard behavior and redundant total/leaf columns with focused tests

Why

The combined #163/#164 artifact regressed against latest-local eCPS because one arbitrary MD PUF-support clone row moved from about $37M rough income to about $109M. Since PUF has no state geography, that single state-inherited row dominated the Maryland AGI top-tail target after calibration. This is a temporary production guard until MP has state-aware top-tail support records.

Checks

• uv run --python 3.13 --extra dev --extra policyengine ruff check src/microplex_us/pipelines/us.py tests/pipelines/test_us.py
• uv run --python 3.13 --extra dev --extra policyengine ruff format --check src/microplex_us/pipelines/us.py tests/pipelines/test_us.py
• uv run --python 3.13 --extra dev --extra policyengine pytest tests/pipelines/test_us.py -k "puf_support_clone_top_tail_guard or puf_support_clone_refresh"
• uv run --python 3.13 --extra dev --extra policyengine pytest tests/pipelines/test_us.py

Review Fix

An independent read-only review found the first version double-counted capital_gains with LTCG/STCG and dividend totals with dividend leaves. The branch now computes rough AGI on a canonical nonredundant basis and has a regression test proving below-cap rows with both totals and leaves are left unchanged.

Follow-up

If this merges, rebuild the CPS-spine Gate-1 artifact and rerun the primary latest-local eCPS sound comparison. The guard should remove the #163/#164 state AGI blow-up; SNAP remains the next separate loss lane.