Use python3 for sandbox commands and interpreter-agnostic test runs

[RollNuts]

Summary

On a fresh macOS clone (which ships only python3, not a bare python), the guided /try walkthrough failed at first run:

• python scripts/materialize_fixtures.py … (step 3) → command not found: python
• Even aliased, the materializer's internal scenario test step (python -m pytest -q from the manifest) → FileNotFoundError: 'python' at verify_scenario, before any fork write.

verify_fixtures.py had the same bare-python subprocess call.

Changes

• materialize_fixtures.py / verify_fixtures.py: run the scenario test command with sys.executable (the interpreter that launched the script) instead of whatever bare interpreter the manifest names. Interpreter-agnostic; no dependency on a python symlink.
• README.md / demo-manifest.json: document python3 for the copy-paste commands (materialize, pytest, check_docs, verify_fixtures).

Validation

• py_compile both scripts: OK. demo-manifest.json: valid JSON.
• Clean-room repro on this macOS host (no python on PATH): before → FileNotFoundError: 'python'; after → verified collide-a: fixture-v1-agent-a -> f21bd2b52905 (base/diff/tests ok), i.e. the scenario tests run under python3, then the run correctly stops at the fork read.
• Upstream-refusal guard re-confirmed unaffected.

Veripsa

• Veripsa state observed: opening now
• No material collision expected (portability fix; scripts + docs)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[veripsa-core]

Veripsa — heading to main

❓ Unknown — not enough signal to call this clear

This PR reserves: demo-manifest.json, scripts/materialize_fixtures.py, scripts/verify_fixtures.py

Blast radius (structurally downstream on main): scripts/check_docs.py, scripts/materialize_fixtures.py, scripts/verify_fixtures.py

Not analyzed (unverified, not 'safe'). These paths aren't in main's graph yet — a new file, an unsupported language, or an un-indexed area — so Veripsa can't compute their blast radius: demo-manifest.json. Treat as unknown, not clear.

_{Veripsa records what is heading to main and who reserved what — it does not assert correctness. Advisory by default; your branch-protection policy decides what blocks.}