Bind combined runs as an ordered composition of reform identities

[MaxGhenis]

Fixes #578

Draft, stacked on #571 (receipt schema v1); review origin/w4/receipt-schema-v1...HEAD. I'll retarget it to main when #571 merges.

Why

The UK Budget dashboard's combined simulation applies several measures in one Scenario. The engine takes one simulation_modifier, so the combined Scenario's modifier composes the members' module-level modifiers. scenario_reform_identity rightly refuses that composed closure. That leaves a combined run with any structural member without a valid reform identity, and reform is required in schema v1.

What this adds

composed_reform_identity(members: Sequence[ReformIdentity], *, name=None) -> ReformIdentity

• representation: policyengine-uk.scenario_composition/v1;
• payload: {"members": [{"representation", "reform_sha256", "binding"}, ...]} in application order;
• binding: code_revision if any member's is, else content.

Each member is still bound on its own with reform_identity or scenario_reform_identity, so every modifier remains a module-level function bound by source and revision.

What the representation means: one policyengine-uk Scenario whose parameter_changes are the members' changes merged, and whose simulation_modifier applies the members' modifiers in the listed order, after the parameter changes. The composer must check that no two members set one parameter to different values; this function sees only identities and cannot. The docs state that as a condition of using the representation.

reform_identity refuses the composition representation, as it refuses the Scenario one, so a composition can only be built from bound identities.

Invariants (each tested)

1. The digest is exactly the ordered member identities. It equals content_sha256 of the stated payload (example test).
2. Order matters; current law and labels do not (Hypothesis). Reordering distinct members changes the digest. Inserting current_law members anywhere, or relabelling members, does not. Dropping or duplicating a member changes it.
3. Binding. The composition is code-bound exactly when a member is.
4. Nothing is current law. An empty or all-current-law composition is current_law. A single member keeps the composition representation, so its digest differs from the member's own.
5. Only bound identities compose. Dicts, strings, raw payloads and non-identity members are refused.
6. Model and schema agree. A receipt with a composed reform validates against the regenerated JSON Schema and round-trips.

Compatibility

This adds one value to the representation enum in the v1 schema. v1 is unreleased, so no published schema changes.

Checks run locally

• 159 tests pass in tests/test_execution_receipt.py.
• ruff and mypy are clean; generate_receipt_schemas.py regenerated the schema.

axiom: n/a: provenance/infrastructure contract, no policy change.

🤖 Generated with Claude Code