fix(python): preserve explicit virtualenv launchers

[dipeshbabu]

Fixes #194

Summary

• Preserve explicit executable paths outside the protected repository after canonical trust validation.
• Keep repository-local links pinned to the canonical executable that passed the trust check.
• Add a regression that models a Python virtualenv launcher whose symlink path is required for the environment to work.

Root cause

The trusted-executable boundary used realpath() both to validate and to invoke every explicit path. On POSIX, a virtualenv's bin/python is commonly a symlink to the system interpreter. Executing that canonical target bypassed the virtualenv's site-packages, so Python 3.10 could no longer import the required tomli package.

Impact

Documented pythonPath, --python, and PYTHON values can point to a Python 3.10 virtualenv without losing its installed packages. PATH sanitization and repository-controlled executable protections remain intact.

Validation

• pnpm dlx bun test --timeout 30000 ./tests-ts/trusted-executable.test.ts — 5 passed, 1 platform skip
• Added a POSIX runtime regression for explicit virtualenv launcher preservation
• pnpm exec tsc --noEmit
• pnpm exec prettier --check src/trusted-executable.ts tests-ts/runtime.test.ts
• git diff --check