harness: fix py-vs-python3 doc gap — add py.sh resolver, repoint skill/command docs

The skill/command DOCS instructed Claude to run a bare `py ...`, which is the
Windows py-launcher — absent on Linux/macOS (exit 127, hit on GURU-KALI). A blind
py->python3 swap is wrong too: python3 is a broken MS Store shim on some Windows
boxes where `py` is the correct launcher.

Fix mirrors the resolution the .sh skill scripts already do:
- New .claude/scripts/py.sh: picks the interpreter that actually RUNS —
  identity.json python.command first, then py -> python3 -> python, each
  validated with `-c 'import sys'` so the MS Store stub is skipped. exec's it.
- Repointed all DOC invocations (10 files, ~70 sites) from `py ...` to
  `bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" ...` (incl. the `py -c` and
  `py -` heredoc forms in checkpoint.md / mailbox.md).
- Left the .sh skill scripts untouched — they already resolve py/python/python3.
- errorlog.md: marked the GURU-KALI entry RESOLVED.

Depends on CLAUDETOOLS_ROOT (seeded by ensure-settings-env.py); py.sh also
self-resolves the repo root via git/cwd as a fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/scripts/py.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Purpose: Resolve the Python interpreter that actually WORKS on this machine and exec it
+#          with the given args. Skill/command docs call this instead of a bare `py` so the
+#          same documented command runs everywhere.
+# Why:     `py` is the Windows py-launcher (absent on Linux/macOS -> exit 127), while
+#          `python3` is a broken MS Store shim on some Windows boxes. Neither literal is
+#          portable. This picks the first interpreter that genuinely executes.
+# Usage:   bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" <script.py> [args...]
+#          (mirrors the py/python/python3 fallback already used inside the .sh skill scripts)
+# Origin:  added 2026-06-14 to close the py-vs-python3 doc gap (errorlog.md, GURU-KALI).
+set -u
+
+# A candidate is only valid if it RUNS — this skips the MS Store python3 stub, which
+# exists on PATH but exits non-zero (prompting a store install) instead of executing.
+_works() { command -v "$1" >/dev/null 2>&1 && "$1" -c 'import sys' >/dev/null 2>&1; }
+
+PY=""
+# 1) Honor identity.json's declared command first (authoritative per-machine), if it works.
+ROOT="${CLAUDETOOLS_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+ID="$ROOT/.claude/identity.json"
+if [ -f "$ID" ]; then
+  cand=$(sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$ID" | head -1)
+  [ -n "$cand" ] && _works "$cand" && PY="$cand"
+fi
+# 2) Fall back to autodetect: py (Win launcher) -> python3 -> python, first that works.
+if [ -z "$PY" ]; then
+  for c in py python3 python; do _works "$c" && { PY="$c"; break; }; done
+fi
+
+[ -z "$PY" ] && { echo "[py.sh] no working python found (tried identity.json, py, python3, python)" >&2; exit 127; }
+exec "$PY" "$@"