Stop datasets auto-saving on construction (fixes region-scope corruption)

[anth-volk]

Fixes #449

Problem

Constructing a PolicyEngineUSDataset / PolicyEngineUKDataset with in-memory data= auto-saved to self.filepath (via model_post_init). Region scoping in run() built its filtered copy with filepath=<the source file>, so constructing the scoped copy truncated and overwrote the shared source dataset with a single region's households.

In the simulation API this corrupted the baked single-year dataset file inside reused Modal containers: after a state-scoped run, the shared file held only that state's rows, so the next request on the same container either crashed (ValueError: No households found matching state_fips=N) or, for a national request, silently computed a "national" result on ~1–2% of the population — fast and wrong. This drove ~50% state-run failure rates in 51-state fan-outs (breaking downstream congressional-district breakdowns) and a confusing mix of fast-but-wrong vs. slow-but-correct national runs depending on container reuse.

Fix

• Remove the auto-save branch from model_post_init in both country dataset classes; keep auto-load. Persistence is now always explicit via save().
• run() loads the input dataset only when the caller did not already supply in-memory data (if dataset.data is None: dataset.load()) instead of unconditionally — this is what made the autosave load-bearing, and the change keeps in-memory / notebook workflows working without a disk round trip.
• Dataset.filepath becomes Optional[str]; region-scoped copies are constructed with filepath=None; save() raises a clear error when filepath is None.
• Removes the redundant double-writes of create_datasets outputs and simulation output datasets.

Why this is safe / why the autosave existed

The autosave (PR #180, 2025-11) had one inline rationale — "synchronised between in-memory and storage." No documentation promises that construction persists, and no issue tracked it. It was only load-bearing because run() re-read the input dataset from disk every time; making that read conditional removes the need to persist on construction.

Org-wide search: only policyengine-api-v2 (consumes via ensure_datasets/load_datasets — benefits, no code change) and policyengine-api-v2-alpha (household.py constructs with data=, kept working by the conditional run() load) are external consumers. No org .ipynb constructs these classes directly; populace, policyengine-us-data, policyengine-uk-data, and the country model packages are unaffected.

Tests

New tests/test_dataset_persistence.py:

• test__construct_with_data__does_not_write_to_filepath — construction with data= leaves an existing file's bytes unchanged (fails under the old behavior).
• test__sequential_region_scopes__leave_shared_source_intact — the production incident, at the dataset level: scope state 6 then state 34 against a shared file; both succeed and the file is unchanged.
• save()-without-filepath raises (US + UK); load-on-construction still works; no-filepath/no-data construction is inert.

Existing _write_us_h5 fixture updated to call save() explicitly (it previously relied on the construction side effect).

Validation

ruff format + ruff check clean. Directly-affected suites green: tests/test_dataset_persistence.py, tests/test_us_long_term_datasets.py, tests/test_filtering.py, tests/test_scoping_strategy.py (46 passed). The full suite (incl. microsim run() paths) was still finishing at PR-open time; CI is the source of truth. Draft until CI is green.