ci: replace source-tree PYTHONPATH acceptance with installed-wheel contracts

[seonghobae]

Finding

Canonical Foundation currently executes owned package/service tests by putting repository src directories on PYTHONPATH. That proves source-tree behavior but does not prove the published Python packaging contract. Fresh inspection has now exposed two concrete classes of defect hidden by that arrangement.

First, services/people-api/pyproject.toml declared orgmetra-hris-kernel==0.1.0 while the canonical owned packages/hris-kernel/pyproject.toml version is 0.4.0. Source-tree import injection bypassed dependency resolution, so exact-head Foundation could remain GREEN despite the stale internal pin. Canonical People owner #64 carries the test-first version-pin repair.

Second, both HTTP services advertise Python >=3.11 on protected truth while their mandatory owned HRIS-kernel and Keyverse adapter distributions both require Python >=3.12. The same source-tree execution therefore also hides an impossible interpreter/dependency-closure contract. #64 now carries the People-side >=3.12 repair and a focused runtime-floor regression; #260 has been corrected to own repository-level service runtime metadata/compatibility reconciliation rather than preserving an unsupported Python 3.11 claim.

Required owner order

Do not copy mutable #259 or #64 source. #259/#258 first establish the canonical package-neutral declared-Python Foundation owner on protected develop; #64 then integrates the People metadata corrections through its normal owner path. #260 reconciles the remaining service runtime metadata, including Job Analysis, from protected owner truth. This installed-artifact successor must consume those protected contracts rather than preserving stale source-tree assumptions.

Acceptance

• Remove repository-owned package/service test reliance on manual PYTHONPATH as packaging acceptance evidence.
• Build each owned Python distribution from the exact checked-out source using a reviewed, hash-locked build toolchain; build isolation/dependency acquisition must not fetch unreviewed mutable artifacts.
• Compute and record each produced wheel SHA-256 before installation; install/test the exact built wheel, not the source tree or an editable install.
• Resolve Orgmetra-internal service dependencies against the exact owned distribution versions declared in their pyprojects; a stale/missing/duplicate internal pin must fail before service tests.
• Validate that each service's declared Python runtime is compatible with the complete mandatory owned dependency closure; do not claim a lower interpreter solely because service metadata advertises it.
• Keep package/service discovery owner-neutral rather than a package-name switchboard where practical.
• Preserve truthful declared Python compatibility acceptance from ci: preserve declared Python compatibility in canonical Foundation ownership #258/ci: enforce declared Python package compatibility #259 and ci: reconcile service Python runtime metadata and executable compatibility #260. A lower runtime floor is acceptable only when the full installed dependency closure has executable evidence at that runtime.
• Preserve exact 100% statement/branch coverage for owned production code. Coverage must measure the installed artifact and must not silently fall back to src through cwd/import precedence.
• Keep one canonical Foundation quality job on ubuntu-24.04; do not reintroduce package-local workflows or matrix/job admission pressure.
• Prove wheel contents do not accidentally include tests, repository-only files, secrets, or sibling package source, and that package-data such as py.typed is present where declared.
• Add executable regressions for stale internal dependency versions, incompatible dependency runtime floors, source-tree import leakage, wheel digest binding, and clean environment installation.
• Reseal deterministic provenance/manifest inputs from final bytes and acquire fresh exact-head Foundation/SAST/Security/CodeQL/review evidence before protected integration.

No cross-service SQL, mutable sibling source copy, editable install, unpinned build backend download, PYTHONPATH workaround, coverage exclusion, no-op retrigger, force-push, destructive rebase, self-approval, routine administrator bypass, or gate weakening is an acceptable substitute.