fix(python): make ruff and pytest toolchain status honest

[EivMeyer]

Parent

EPIC #243. Tracking parent only: implementation is delivered sequentially by #258 and #259. Do not launch one implementation run against this umbrella.

Goal

Make optional Ruff and pytest reporting truthful: an installed or discovered optional tool is inventory only until an explicitly selected check executes it. Preserve python.source-hygiene as Opcore policy and python.relevant-tests as graph candidate evidence; neither impersonates Ruff or pytest execution.

Correct prerequisites

• P0 — Resolve Python projects, interpreters, environments, and tools canonically #246 — canonical project/interpreter/config/tool context (complete)
• fix(python): share import resolution between validation and graph #209 — canonical Python import/source closure (complete; required by pytest candidate selection)
• Hypothetical (validate pre-write) evaluation must be comprehensive — graph-backed checks are silently skipped #197 — accepted exact after-state graph/file view (complete; replaces the stale closed-duplicate dependency)
• P0 — Harden Python type checking and configuration semantics #245 — production type-authority tracker, completed by both P0: Make mypy the exact authoritative Python type gate #256 and P0: Complete the authoritative Python type gate with Pyright #257 before this lane starts

Delivery graph

Child	Capability	Authority/evidence	Order
#258	opt-in python.ruff-lint and python.ruff-format	✅ merged in PR #283 (83f9bcef9b6419b092ec252eae299ca8c6936763); real Ruff 0.6.9 packed proof and fresh opcore-ci recorded	first
#259	opt-in python.pytest	✅ merged in PR #290 (6ed9e0e5b48acdc298af1a2e1af1a59aae32ac78); real pytest 8.4.1 source/packed authority matrix and fresh opcore-ci recorded	after #258

Invariants

1. Unrequested optional checks are not_applicable; policy-disabled checks are disabled. Neither state probes or invokes a process, degrades enforced coverage, or emits pass/findings metrics.
2. Missing Ruff or pytest degrades only an enabled consuming check. Tool discovery without a consuming enabled check is inventory, not coverage.
3. python.source-hygiene remains an Opcore policy check. It is not Ruff lint or format evidence.
4. python.relevant-tests reports only TESTED_BY candidates. Candidate presence/absence is not pytest collection, execution, pass, or fail evidence; existing untested/pass wording and metrics must be renamed accordingly.
5. Both children reuse Hypothetical (validate pre-write) evaluation must be comprehensive — graph-backed checks are silently skipped #197 exact after-state materialization and P0 — Resolve Python projects, interpreters, environments, and tools canonically #246 project/tool selection. They preserve per-project evidence, fail closed on malformed/timeout/crash/resource/config states, and never install tools or mutate source/config/lock/environment/cache state.
6. Multi-project evidence is additive: one project's clean result cannot erase another project's findings or failures.
7. ASP/provider execution is limited to selected check IDs. Public status, metrics, packed execution, and diagnostics derive only from actual capability receipts.

Original acceptance mapping

Original need	Owner
Every degraded Ruff state maps to an enabled real check	#258
Every optional Ruff status maps to execution/provenance	#258
Every test status distinguishes candidates, collected, executed, pass/fail/no-tests	#259
Missing tools are conditional on activation	both children
Source-hygiene and graph candidate evidence retain honest names	#258/#259 respectively
Real tools, overlays, cleanup, ASP, status/metrics, packed public proof	each child for its capability

Closure gate

Close only after both child PRs merge to dev, every original acceptance row links to focused and packed evidence, activation/missing-tool behavior is proven with zero-process assertions, source/config/lock/environment/cache cleanliness is recorded, local opcore-ci passes, and #243 is updated. This tracker authorizes no Python readiness/parity, security/sandbox, automatic-fix, or old-tool replacement wording; #251 owns public release claims.