fix: make calibration staleness detection content-based

[koen-vg]

Problem

tools/calibrate --check asked Snakemake whether a dry run would do anything,
which is an mtime question. The five calibration steps write into one directory
that they all read from, so re-running any step marked its successors stale even
when the artefacts came back byte-identical, and a git checkout marked
everything stale. It never converged, and the guidance in the docs had degraded
to "treat [STALE] as worth investigating, don't chase it to all-green".

It also had a false negative: calibrate_deviation_penalty runs its solves
in-process, so it never declared the calibration artefacts those solves read.

Approach

A step is stale when re-running it would change its artefacts, which depends
only on inputs from outside the artefact set. Each set now carries a
fingerprint.yaml hashing exactly those:

• every external leaf of the step's Snakemake DAG (curated, bundled and
  manually downloaded data, the build_model package),
• the rule files and scripts that DAG runs,
• the step config, hashed after a YAML round-trip so comment and formatting
  edits do not register,
• the artefacts the step wrote, so one edited or checked out behind the chain's
  back is reported rather than silently trusted.

The DAG is rebuilt on each check through the Snakemake Python API, so a
dependency that a rule or code change adds or drops is picked up straight away.
Because the fingerprint ignores the artefact set's own contents, re-running one
step never marks its successors stale.

New tools/calibrate --record re-stamps a set without solving, for code changes
that provably cannot move the artefacts.

Fixes that fell out of building the DAG honestly

• Solve-time calibration artefacts (feed corrections, exogenous feed and forage,
  food-demand multipliers, the calibrated deviation penalty) were declared as
  inputs of solve_model but not of calibrate_deviation_penalty. Both now
  share calibration_artefact_inputs.

• health_required built a full deepcopy of the configuration for every
  configured scenario. On gsa.yaml (16384 generated samples) that was ~35 s of
  the ~43 s spent constructing any DAG -- so it slowed down every Snakemake
  invocation against a generated ensemble, not just the check. Reading the
  overrides directly brings Snakefile parsing to ~4 s at an identical 848-job
  DAG.

Verification

Timings on this workstation, gbd-anchored set: --check 3m15s -> 32 s;
default set ~19 s.

Behaviour matrix, all confirmed correct:

change	expected	observed
touch every artefact + a curated input	all up-to-date	all up-to-date
hand-edit a feed artefact	all 5 stale	feed "artefact modified since it was generated", rest "input content changed"
add a file inside a manually-downloaded IHME directory	all 5 stale	"input content changed"
edit a workflow script or rule file	stale	stale
cost.yaml slack_marginal_cost 7.5 -> 7.6	only cost	only cost
comment-only config edit	up-to-date	up-to-date
full workflow run that reclaims temp() downloads	up-to-date	up-to-date

pixi run -e dev pytest 715 passed; test-integration passes; ruff and the
REUSE hook clean. New tests/test_calibration_fingerprint.py covers the
comparison logic and the YAML/directory hashing.