Emit kg-phenio release metadata (kozahub-metadata-schema)

[kevinschaper]

Summary

kg-phenio now writes output/release-metadata.yaml describing the upstream sources consumed (phenio + the two upheno SSSOM mappings) and the artifacts produced (merged-kg.tar.gz). The receipt nests phenio's own per-ontology versions — read from phenio's `phenio-upstream-versions.tsv` release asset — as a `Release` inside the phenio entry, which itself sits under kg-phenio.

The receipt shape (excerpt):

```yaml
source: kg-phenio
source_version: v2026-04-14 # phenio's tag, used as the primary upstream version
build_version: kg-phenio_v2026-04-14__
sources:

• id: phenio
  name: PHENIO
  version: v2026-04-14
  version_method: github_release_api
  sources:
  • {id: infores:bfo, version: 2019-08-26, version_method: owl_version_iri, urls: [...]}
  • {id: infores:chebi, version: 2026-04-20, version_method: owl_version_iri, urls: [...]}
  • {id: infores:mondo, version: ..., ...}

  ~20 ontologies from phenio-upstream-versions.tsv

• {id: infores:upheno-cross-species, ...}
• {id: infores:upheno-species-independent, ...}
  artifacts:
• {path: merged-kg.tar.gz, sha256: ...}
  ```

When monarch-ingest's aggregator picks this up (follow-up PR), HP/MONDO/CHEBI/etc. versions in monarch-kg's receipt trace back through `kg-phenio → phenio → infores:`, full provenance preserved.

Files

• `versions.py` (top-level, outside the `kg_phenio/` package so the metadata script doesn't pull in kgx via package init): `get_source_versions()` builds the nested phenio `Release` plus the two upheno peer leaves.
• `scripts/write_metadata.py`: standard kozahub-metadata-schema wrapper.
• `pyproject.toml`: `kozahub-metadata-schema` git dep.
• `Jenkinsfile`: new `Metadata` stage between Merge and Publish; the file is included in the s3 sync alongside the KG tarball.

Test plan

• Local dry run with phenio's manifest from an unreleased checkout: `PHENIO_MANIFEST_PATH=../phenio/src/ontology/phenio-upstream-versions.tsv python scripts/write_metadata.py` produces a valid receipt with all 6 ontologies (bfo/bspo/chebi/monochrom/pato/ro) showing real versions, plus the upheno mappings with `http_last_modified` versions.
• First production Jenkins build of kg-phenio after merge — confirms the Metadata stage runs and the file lands in s3.

Notes

• The next phenio release will publish `phenio-upstream-versions.tsv` (`RELEASE_ASSETS` in `phenio.Makefile` already references it). Until then the production fetch will 404 and the `Metadata` stage will fail — by design (we'd rather notice loudly than silently emit an empty manifest).
• Companion PR coming on monarch-ingest to support a non-default metadata URL so kg-phenio's receipt (which lives at `https://kg-hub.berkeleybop.io/kg-phenio/current/release-metadata.yaml\`, not a GitHub release) can be fetched by `ingest download-release-metadata`.