fix(pii): honor abort in quick mode, accept any regex resource, download it per job

[jqnatividad]

Follow-up to #343. A local review of its commits found three more PII-screening problems that were already on main. I confirmed each one against the code.

1. The abort setting was ignored in quick mode when previews were on. With pii_quick_screen, pii_show_candidates and pii_found_abort all on, found PII matched neither the abort branch (which required previews to be off) nor the preview branch (which required quick screening to be off). Ingestion carried on unless the review gate stopped it.
   • Quick screening stops at the first match and has no candidate rows to preview, so pii_show_candidates can't apply. It now aborts.
   • When quick screening finds PII and abort is off, it now logs a warning. That case was silent before.
2. A custom regex resource had to have a DataStore table, though its file is then downloaded. A plain uploaded regex file was rejected (since fix(pii): make PII screening work with its default regexes #343, with a clear error; before that, with a crash). The resource is now looked up with resource_show. A missing resource is still a clear JobError.
3. Every job shared one downloaded regex file. Custom regexes were downloaded to user-pii-regexes.txt in the package directory. Concurrent jobs could overwrite each other's copy mid-scan, and the package directory may not be writable. They now go in the job's own temp_dir.

The pii_show_candidates and pii_regex_resource_id_or_alias entries in config_declaration.yaml now explain these behaviors.

Tests (tests/test_pii_screening_search.py, run against the real qsv):

• A custom regex resource works without a DataStore table, in both modes. The test checks it's fetched with resource_show, never with the DataStore check, and downloaded into the job's temp dir, not the package dir.
• Quick mode aborts on PII even with pii_show_candidates on.
• Quick mode without abort warns and returns (True, 1).
• The missing-resource test now mocks resource_show raising ObjectNotFound.

Four mutations each made the new tests fail: the old abort condition, no warning, requiring a DataStore table again, and downloading into the package dir. The unit suite passes in dpp-test (342 passed).

🤖 Generated with Claude Code