feat(python): support uv and pip contracts

[rldyourmnd]

Summary

• add explicit uv and pip modes to python-ci
• use pinned hosted setup or exact preinstalled ephemeral toolchains
• require pip callers to own their dependency install policy
• add a hosted pip runtime fixture
• correct Python and Node capability metadata after the Node contract expansion

Permissions diff

No permission expansion; all jobs remain contents: read under permissions: {}.

Threat model

Unknown managers and invalid versions fail before installation. Caller commands remain environment-bound and execute with bash -euo pipefail -c. Preinstalled mode is opt-in and verifies the exact interpreter/tool version.

Validation

• actionlint
• all validation tiers with live ruleset access
• zizmor@1.26.1 pedantic/low — no findings
• generated docs check
• git diff --check