fix(runtime): keep APM truststore bootstrap out of ensurepip on llm re-setup

[Daniel Meppiel (danielmeppiel)]

Description

Root cause of the last release-gate failure (test_dual_runtime_installation, apm runtime setup llm), surfaced by #3253's diagnostic in dispatch run 38905430799:

pip/_vendor/truststore/__init__.py: _sslobj = _ssl.create_default_context().wrap_bio(
.../llm-venv/.../truststore/_api.py: raise ValueError("check_hostname requires server_hostname")

Re-running apm runtime setup llm over an existing llm venv (the e2e module reuses its HOME; real users re-run setup too) recreates it while APM's _apm_tls.pth bootstrap is present. ensurepip launches its bundled pip via python -c "runpy...", which the bootstrap's pip-process check misses, so truststore is injected into ssl. pip's vendored truststore then probes wrap_bio without a hostname, which truststore 0.10.5 rejects.

Fix: run the pip bootstrap with APM_DISABLE_TRUSTSTORE=1 (bash and PowerShell). Every shipped bootstrap honors this, so existing venvs are covered; pip still verifies against the OS store through its own vendored truststore.

Issue and approved scope

Issue: N/A -- maintainer-directed CI repair blocking the v0.34.0 release (#3250); follow-up to #3251, #3253.

Human scope-approval comment: Daniel Meppiel (@danielmeppiel) directed in-session: "loop and bypass merge PRs until they're fixed and we know that the release workflow would pass".

Does this PR complete the issue, or what remains? Completes the known release-gate failures; a post-merge manual-build-release dispatch verifies.

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally

• All existing tests pass

• Added tests for new functionality (if applicable)

• uv run --extra dev pytest tests/integration/test_tls_r3_verify.py -- 11 passed, 1 skipped (new script-contract assertion).

• Re-ran setup-llm.sh over an existing venv with _apm_tls.pth installed -- succeeds.

• In that venv, ssl.create_default_context() is truststore._api by default and stdlib ssl with APM_DISABLE_TRUSTSTORE=1, confirming the bootstrap is bypassed for ensurepip.

• truststore 0.10.5 is not available on the local package mirror, so the exact ValueError was observed only in CI.

Spec conformance (OpenAPM v0.1)

• Spec edit: docs/src/content/docs/specs/openapm-v0.1.md updated
  (new/changed <a id="req-XXX"></a> anchor + prose + Appendix C
  row).
• Manifest edit: docs/src/content/docs/specs/manifests/openapm-v0.1.requirements.yml
  updated.
• Test edit: a @pytest.mark.req("req-XXX") test under
  tests/spec_conformance/ added or extended.
• CONFORMANCE.{md,json} regenerated via
  uv run --extra dev python -m tests.spec_conformance.gen_statement
  and committed.
• N/A -- this PR does not change OpenAPM-observable behaviour.

[Copilot]

🟢 Approval recommended

The narrowly scoped changes preserve normal runtime TLS behavior, with no identified blocking issues.

No open issues 🎉

What changed in this PR

Prevents APM's truststore bootstrap from interfering with pip when re-running LLM runtime setup, addressing the release-gate failure exposed by #3253.

Changes:

• Disables APM truststore injection during pip bootstrapping on Bash and PowerShell.
• Adds script-contract assertions for both setup paths.

File	Description
tests/​integration/​test_tls_r3_verify.py	Checks both scripts include the bootstrap opt-out.
scripts/​runtime/​setup-llm.sh	Scopes the opt-out to ensurepip.
scripts/​runtime/​setup-llm.ps1	Temporarily sets the opt-out and restores its previous value.

_{Review effort: Balanced}