fix: enforce hermetic Python execution

[rldyourmnd]

Summary

Implements the first isolated slice of #129: one hermetic Python execution and child-environment contract for all repository validators and generators.

• adds a machine-readable 41-subject inventory with exact import, dependency, resource, subprocess-edge, interpreter, and environment policy;
• launches registered subjects only through Python 3.13 isolated mode, rejects unknown/traversing tools and shadow imports, and pins PyYAML ownership;
• replaces ambient subprocess environments with one semantic transition that strips every PYTHON* key, canonicalizes locale, permits only registered inheritance, and records names-only stripped/inherited evidence;
• adds cold import/name/side-effect checks and multi-generation hostile-environment regressions while keeping semantic validators independent;
• aligns CI, maintenance, release and evidence-rendering callers, repository docs, authored skills and generated mirrors.

The Android/Flutter/Qt fixture WIP remains separately preserved and is intentionally absent from this PR.

Type of change

• New reusable workflow / capability
• Fix to an existing workflow
• Pinned tool/action version bump
• Hardening / security posture improvement
• Docs only

Threat-model note (required for workflow / permission changes)

The prior validators inherited ambient process state, so PYTHONHOME, PYTHONPATH, startup hooks, shadow modules, locale and unrelated secrets could alter nested fixtures or interpreter bootstrap. The new boundary reconstructs both sys.path and each child environment from machine-owned allowlists. Additional inherited names are explicit per subject and evidence contains names only, never values. Unknown tools, dependencies, inheritance and process edges fail closed. Mutating generators are cold-imported but never executed by the cold gate.

Permissions diff (required for workflow / permission changes)

No permissions: entry changes. Existing jobs retain their exact scopes. Three evidence-summary jobs add the already SHA-pinned actions/setup-python step and remain contents: read; no token write scope, OIDC, secret access or new runner class is introduced.

Checklist

• All third-party actions pinned to a full 40-char commit SHA with a # vX.Y.Z version comment.
• Least-privilege permissions remain unchanged.
• Existing concurrency and timeout-minutes contracts remain intact; no job was added.
• persist-credentials: false remains on the changed evidence-job checkouts.
• No GitHub expression was added inside run:.
• No paid action or cross-tier SARIF behavior changed.
• actionlint passes locally.
• The repository-pinned tokenized zizmor@1.26.1 --persona regular --min-severity low gate passes locally with no findings.
• README, catalog, docs, authored skills and generated mirrors are synchronized.
• CHANGELOG.md is updated under [Unreleased].
• Commit is SSH-signed and DCO signed off.

Validation

• focused Python execution contract: PASS on Python 3.13.13;
• generated docs --check: PASS;
• validate_all.py all tiers: PASS;
• actionlint: PASS;
• tokenized pinned zizmor 1.26.1: PASS, no findings.

Tier impact

• Public (free OSS suite)
• Private free tier (zero-cost only)
• Private paid tier (GHAS / harden-runner features)

[rldyourmnd]

Hermetic Python split — prior recovery cycle Final Attempt3 terminal handoff

Canonical lineage for issue #129 and PR #144. The prior recovery cycle is exhausted; the newly authorized Recovery Attempt1 is a distinct cycle, not Attempt4.

Published PR head remains b26547735fc6a4cee007d85a88090393c90ce794 and is unmerged. Final Attempt3 correction work exists only as preserved uncommitted WIP in /tmp/ci-workflows-python-contract; no correction commit or push followed the failure. Android/Flutter/Qt SDK WIP remains separately preserved in the original worktree and stash@{0}.

Exact first focused command:

/tmp/ci-workflows-python-contract-venv/bin/python -I -B scripts/check_python_execution_contract.py

Exact result: exit 1. Four primary failures:

local active-venv parity selftest failed
hosted active-venv parity selftest failed
dependency-origin selftest rejected canonical venv paths
pyvenv home does not bind the declared base executable

Every subsequent _strict_yaml.py / validator cold-import message was derivative: each bootstrap re-ran the same false pyvenv home identity assertion. It is not evidence of independent import defects.

Generated parity, full validate_all, actionlint, zizmor, correction commit/push, and fresh hosted PR checks were NOT_RUN. Auto-merge was not enabled; no merge occurred. No repair or rerun happened after the focused failure.

The new Recovery Attempt1 must derive pyvenv.cfg home and base-install coherence from observed Python 3.13/uv/GitHub-hosted semantics rather than guessed pathname equality, then run one focused gate under the new failure budget.