feat(validation-python): add opt-in pytest authority

[tomdps]

Closes #259

Implements the JIT-refined #259 tracer on current dev:

• retains graph-backed python.relevant-tests strictly as candidate selection
• adds opt-in graph-required python.pytest collection and execution
• groups candidates by canonical project context and materializes bounded immutable workspaces
• isolates ambient pytest plugins and records portable collection, execution, cleanup, config, cwd, and version evidence
• distinguishes disabled/not-applicable/skipped/findings/tool/infrastructure states without rounding up
• adds source, CLI, ASP, metrics, schema, packed-install, timeout, collection-failure, mismatch, isolation, and cleanup proofs

Verification:

• npm run build
• npm run lint
• node --test tests/validation-python.test.mjs tests/contracts.test.mjs tests/schema-contracts.test.mjs tests/asp-provider.test.mjs tests/opcore-metrics.test.mjs tests/opcore-facade.test.mjs tests/validation-runner.test.mjs tests/validation-cli.test.mjs tests/command-router.test.mjs tests/installed-bins.test.mjs tests/conformance.test.mjs
• node scripts/check-python-pytest-authority.mjs
• zeroshot cmdproof prove opcore-ci (exit 0; result sha256:a19941573a97124b6ff915588b1c713d727fcf74fa433b34d9bb3c74ce9ab7ac; no workspace drift)