Trim packaged Python build tooling

[FernandoAbishai]

Problem

The self-contained macOS app still shipped Python installation/development tooling after the hash-locked core runtime had already been assembled: portable pip/setuptools, ensurepip, C headers/pkgconfig, venv/IDLE/pydoc/lib2to3 helpers, and Tcl/Tk GUI assets.

Those files are not used by ScriptCut's packaged execution path and add about 24 MB to the app.

Change

• explicitly define the bundled Python as an execution-only private runtime
• after installing the hash-locked core pack, remove portable build/install tooling and Tcl/Tk assets
• preserve the Python interpreter, standard runtime modules, and the complete ScriptCut core pack
• make the packaged-runtime gate reject builds that accidentally restore the removed build/GUI tooling
• document that pip/venv/Tk are not supported APIs of the packaged runtime

Measured result

Compared with main before this slice:

• app logical size: 961,728,463 -> 937,609,520 bytes (-24,118,943 / -2.51%)
• DMG: 307,127,822 -> 297,466,783 bytes (-9.66 MB / ~-3.15%)
• portable Python logical category: 68,994,420 -> 44,875,314 bytes

Against the original pre-audit baseline, app logical size is now about 19.63% lower and the DMG about 20.02% lower.

Verification

• runtime artifact/contract smokes: PASS
• bundle-size contract: PASS
• self-contained arm64 DMG build: PASS
• packaged runtime/backend gates: PASS
• Electron-like packaged backend startup: PASS
• packaged Electron renderer transport: PASS
• packaged optional-capability behavior: PASS
• real packaged Whisper lifecycle: PASS (first download/transcription, offline reuse, corrupt-model repair, deletion/reacquisition)
• hdiutil verify: PASS
• independent read-only review: no MUST-FIX findings
• git diff --check: PASS

Scope

This does not remove any product feature or optional packaged capability. Developer-only Python APIs such as pip/venv/Tk and build-extension tooling are intentionally outside the supported packaged-runtime contract.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.