Import, validate and activate government payroll

Uploads are staged first. Invalid rows never become eligible, duplicate files are blocked, and maker–checker approval prevents the uploader from approving their own batch.