feat(validation-python): complete Pyright authority

[tomdps]

Closes #257

Delivered

• executes the selected pre-provisioned Pyright authority against the canonical exact after-state project
• preserves recursive config/source/stub semantics, project boundaries, interpreter provenance, and fail-closed JSON protocol mapping
• retains one capability receipt per mixed mypy/Pyright project without fallback or co-authority
• proves real Pyright 1.1.411 and packed public Opcore execution
• shares only authority-neutral type-runner/TOML mechanics between mypy and Pyright
• keeps raw authority fixtures out of repository changed-file validation through the established .fixture convention

Evidence

• node packages/opcore/dist/index.js check --changed --base origin/dev --json — exit 0
• npm run build
• full tests/validation-python.test.mjs
• affected contracts/schema/policy/ASP/facade/installed-bin suites
• npm run lint
• npm run pack:check
• temp-only real pyright@1.1.411 authority proof, including packed install and exit 3
• opcore-ci proof exit 0: sha256:0a27c4c77073c0c301c8e32f49c2b434b3cca998b55fcb1be5e368057a93de88
• real pre-commit hook passed on commit 35046e52bcb7fdc6584a27b23ee474cd98ccf6a1

No Python readiness/parity, ASP authority, old-tool replacement, security/SAST, all-stack, automatic-fix, or blended-score claim.