feat(python): add authoritative mypy type gate

[tomdps]

Closes #256

What changed

• adds the public PythonValidationCapabilityRun contract and preserves project-keyed runs through validation, aggregation, reporting, ASP, schemas, fixtures, and installed artifacts
• makes mypy the exact configured/explicit per-project type authority over the canonical after-state, with no availability fallback and typed unsupported Pyright evidence for P0: Complete the authoritative Python type gate with Pyright #257
• executes mypy through strict NDJSON machine output with portable provenance, fail-closed protocol/range/timeout/tool handling, safe config isolation, and guaranteed temporary-workspace cleanup
• adds real mypy 2.3.0 clean/overlay/materialized proof covering strict mode, plugin, stubs, namespaces, output-path refusal, host-plugin refusal, and exact manifest equivalence
• keeps public Python readiness wording deferred to P2 — Ship honest Python readiness, setup, receipts, and cross-platform cutover #251

Verification

• npm run build
• focused 12-file run: 364 tests passed
• OPCORE_REAL_MYPY=/tmp/opcore-issue-256-mypy-venv/bin/mypy npm run python:mypy-authority-proof using mypy 2.3.0
• npm run lint
• npm run pack:check
• opcore check --changed --json with canonical mypy available: exit 0
• zeroshot cmdproof check opcore-ci: exit 0, profile passed, no workspace drift
• proof digest: sha256:bb3a22089f574914401054f4a330ade68aad5a5fdf3e1de0d5ef1a51c7278cf8

No native artifact or checked-in release receipt churn. No Python readiness/parity, ASP authority, old-tool replacement, security/SAST, all-stack, automatic-fix, or blended-score claim.