harness: fix py-vs-python3 doc gap — add py.sh resolver, repoint skill/command docs

The skill/command DOCS instructed Claude to run a bare `py ...`, which is the
Windows py-launcher — absent on Linux/macOS (exit 127, hit on GURU-KALI). A blind
py->python3 swap is wrong too: python3 is a broken MS Store shim on some Windows
boxes where `py` is the correct launcher.

Fix mirrors the resolution the .sh skill scripts already do:
- New .claude/scripts/py.sh: picks the interpreter that actually RUNS —
  identity.json python.command first, then py -> python3 -> python, each
  validated with `-c 'import sys'` so the MS Store stub is skipped. exec's it.
- Repointed all DOC invocations (10 files, ~70 sites) from `py ...` to
  `bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" ...` (incl. the `py -c` and
  `py -` heredoc forms in checkpoint.md / mailbox.md).
- Left the .sh skill scripts untouched — they already resolve py/python/python3.
- errorlog.md: marked the GURU-KALI entry RESOLVED.

Depends on CLAUDETOOLS_ROOT (seeded by ensure-settings-env.py); py.sh also
self-resolves the repo root via git/cwd as a fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/mailprotector/references/api.md

@@ -137,7 +137,7 @@ state first with `config <scope> <id>` and look at
 ## Raw escape hatch
 
 ```
-py mp.py raw <METHOD> <path> [--body JSON] [--confirm]
+bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" mp.py raw <METHOD> <path> [--body JSON] [--confirm]
 ```
 Non-GET methods require `--confirm`. Use for any endpoint not wrapped by a named
 command.
@@ -147,8 +147,8 @@ command.
 Releasing a held **spam** message will fail (or silently no-op) if the owning
 entity does not have `permissions.messages.allow_spam_release = true`. The fix:
 
-1. `py mp.py config <scope> <id>` — confirm `allow_spam_release` is `false`.
-2. `py mp.py enable-release <scope> <id> --confirm` — flip it to `true`.
+1. `bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" mp.py config <scope> <id>` — confirm `allow_spam_release` is `false`.
+2. `bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" mp.py enable-release <scope> <id> --confirm` — flip it to `true`.
 3. Re-run the `release` / `release-many`.
 
 Virus and policy quarantines are governed separately — only spam release is