feat: add canonical Python project-context resolver

[tomdps]

Closes #246.

Implements the sole shared Python project/interpreter/environment/tool resolver for validation, scan, status, doctor, install/init, metrics, ASP, and installed-artifact paths. Integrates compiler provenance from #244, discovers nested projects and supported lock/config files through overlay-aware workspace callbacks, enforces PEP 440 target constraints, emits source-safe deterministic fingerprints, and keeps unresolved/ambiguous/degraded outcomes honest.

Post-implementation maintainer review repaired six correctness gaps before merge:

• ASP executable probing is available only when the host launches the provider with cwd exactly bound to the initialized workspace root; mismatched roots remain callback-only and degraded.
• context caches bind to the current validation file view and after-state fingerprint.
• mypy/Pyright explicit config paths are validated and rewritten into the materialized after-state workspace.
• exact, wildcard, compatible-release, major-only, and prerelease PEP 440 semantics are covered.
• setup.cfg python_requires is parsed statically.
• configured Pyright wins deterministically without running both checkers.

Verification at head 25084bd:

• npm run build
• npm run lint
• node --test tests/contracts.test.mjs tests/validation-python.test.mjs tests/opcore-facade.test.mjs tests/asp-provider.test.mjs tests/installed-bins.test.mjs: 177/177
• installed packed-bin suite: 3/3, including exact status/scan/check/ASP context identity
• opcore check --changed --json: exit 0
• zeroshot cmdproof check opcore-ci: exit 0, profile contract passed, no workspace drift; proof sha256:b8e6b9e171e929cf518c4f8768c1474ba46187462f7d9ea087a0812d5eac585d
• CI package installation suppresses registry audit/funding calls; the focused packed-bin suite passes without changing package semantics.

Generated native artifact churn was restored before commit.