fix: use positional alignment in contrib functions to prevent cartesian-product OOM

[drussellmrichie]

Problem

_contrib_to_unit_values and _add_prediction_to_contribution both join df_contrib back to df_base / df using pd.merge(..., on=the_key, how="left"). This produces a cartesian product and an OOM crash under the following combination of conditions:

1. df_base has a non-sequential index (e.g. after sort_values() — the index retains the pre-sort positions).
2. The join key ("key" or "key_sale") is backed by PyArrow string dtype, which triggers pandas' slow/non-unique merge path even when the key values are logically unique.
3. The dataset is large enough that the intermediate cartesian product exhausts memory (observed on a ~421k-row universe: 421k² rows attempted).

The crash surfaces as a MemoryError or silent process kill inside pd.merge before the result is materialized.

Why positional alignment is correct

df_contrib is constructed row-by-row from df_base in the same iteration, so the two DataFrames are always in the same row order. A reset_index + pd.concat(..., axis=1) is therefore semantically equivalent to the merge, without the non-unique-join hazard.

A size-mismatch guard falls back to the key-based merge with a UserWarning, preserving correctness in any unexpected edge case.

Fix

• _contrib_to_unit_values: replace unconditional merge with positional reset_index + concat; fall back to merge with a warning if row counts differ.
• _add_prediction_to_contribution: same pattern.

Reproducing

The crash is difficult to reproduce on a small synthetic dataset because small Arrow string columns typically fall through to pandas' fast unique-key path. It was observed on a real Philadelphia OPA dataset (~421k parcels). No minimal repro is included with this PR; if a test fixture is needed we can work on one together.

[github-actions]

Thank you for your contribution.
Please sign our CLA at the following link:
Click here to sign the CLA.
A maintainer will verify your signature and confirm it here by commenting with the following sentence:

---

I affirm that this contributor has signed the CLA

---

0 out of 3 committers have signed the CLA.
❌ @claude
❌ @drussellmrichie
❌ @russell Richie
Russell Richie seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}