fix: automatically provision Reactor on first render

[atomantic]

Summary

A fresh install with a Reactor API key previously rejected every render unless the operator manually installed a Python SDK. The first authorized render now prepares a private Python 3.12 and pinned SDK automatically, using a checksum-verified uv release. Healthy environments are reused; broken installations are repaired, concurrent jobs share preparation, and cancellation during setup never opens a paid session. Existing custom runtime overrides are verified without modifying them.

Retain the headless Python/WebRTC capture adapter: Reactor's JavaScript SDK depends on browser WebRTC APIs, and its recording API also requires a live session with model recording support. Document this distinction and remove the manual-setup requirement. Delete partial capture directories on failure or cancellation, retain verified installer downloads for repairs, and allow bounded time for slow downloads. No installation or provider call runs at server boot.

Test plan

• Passed 103 tests across Reactor adapter/runtime, offline Python capture, and child-process convention suites.
• Clean-room automatic setup downloaded private Python and the native SDK successfully on macOS ARM64, without a system Python dependency or a paid session.
• Deleted the temporary SDK's native library and confirmed automatic setup repaired it successfully.
• Read-only Claude review completed its configured one-round budget; findings addressed and focused tests rerun.
• No paid live render performed. Windows and Linux provisioning require CI/platform validation; supported SDK wheels determine platform support.