fix(python): preserve explicit virtualenv launchers

[dipeshbabu]

Fixes #194

Summary

• Preserve explicit executable paths outside the protected repository after canonical trust validation.
• Keep repository-local links pinned to the canonical executable that passed the trust check.
• Add a regression that models a Python virtualenv launcher whose symlink path is required for the environment to work.

Root cause

The trusted-executable boundary used realpath() both to validate and to invoke every explicit path. On POSIX, a virtualenv's bin/python is commonly a symlink to the system interpreter. Executing that canonical target bypassed the virtualenv's site-packages, so Python 3.10 could no longer import the required tomli package.

Impact

Documented pythonPath, --python, and PYTHON values can point to a Python 3.10 virtualenv without losing its installed packages. PATH sanitization and repository-controlled executable protections remain intact.

Validation

• pnpm dlx bun test --timeout 30000 ./tests-ts/trusted-executable.test.ts — 5 passed, 1 platform skip
• Added a POSIX runtime regression for explicit virtualenv launcher preservation
• pnpm exec tsc --noEmit
• pnpm exec prettier --check src/trusted-executable.ts tests-ts/runtime.test.ts
• git diff --check

[mldangelo-oai]

@codex review exact head 51bb7ca

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8fe4caea7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Canonicalize aliased repository launchers

When an explicit path reaches a repository-local launcher through an alias outside the protected root (for example, protectedRoot=/real/repo and /tmp/repo-alias/python, where repo-alias points to that repository), current.path appears outside root even though its parent is repository-controlled. If python initially links to a trusted system interpreter, validation succeeds and this branch returns the mutable repository path; retargeting that link after the probe causes subsequent plugin invocations to execute repository code. Canonicalize the launcher's parent before deciding whether its invocation path is outside the protected root.

Useful? React with 👍 / 👎.