ci: remove obsolete Base-local lib/python paths #2649

Goal

Remove obsolete Base-local lib/python source-root entries from Python test, lint, security-scan, and CI configuration while preserving the real standalone base-cli/lib/python provider path.

Background

Base-owned Python packages live under cli/python; the documentation branch for #2628 inventories all 18 tracked packages and states there is no Base-local lib/python source tree. The current lib/python entries in pytest/Pylint configuration, CI workflows, and contract tests are historical no-op search paths. The external base-cli/lib/python source root remains required for provider-source validation and must not be removed.

Scope

• Confirm repository-local Python source and test roots, then remove only obsolete Base-local lib/python entries from pytest, Pylint, Bandit, compileall, and related workflow configuration where present.
• Update contract tests that pin the obsolete entries and preserve assertions for the external base-cli/lib/python provider path.
• Update Python testing, supply-chain, technical-overview, and Copilot setup guidance to match the resulting commands and source roots. Also update active contributor and agent workflow guidance in CONTRIBUTING.md, skills.md, and .ai-context/WORKFLOWS.md where they include the obsolete Base-local path.
• Keep Base-owned Python modules under cli/python; do not move or restructure packages as part of this cleanup.

Acceptance Criteria

• No Base-owned Python package or helper source is tracked under repository-local lib/python/.
• Test, lint, scan, and compile commands no longer pass the absent Base-local path.
• The standalone base-cli/lib/python provider path continues to work in pinned and moving-source CI lanes.
• Contract tests cover the retained source roots and relevant workflow commands.
• Documentation and AI setup guidance describe the actual commands and distinguish Base paths from the external provider path.

Validation

• Run focused pytest coverage for contract hardening and GitHub workflow contracts.
• Run the repository's Python test and Pylint CI lanes plus security scanners after the configuration changes.
• Run documentation-link validation and git diff --check.

Non-Goals

• Do not change or remove the standalone base-cli/lib/python provider.
• Do not migrate Base packages or alter runtime behavior.
• Do not remove unrelated lib/ shell, Bash, or data assets.

Project Fields

• Status: Backlog
• Priority: P2
• Size: M
• Area: CI
• Initiative: Contract Hardening

Agent Assignment

Assignee: codeforester. Start after the #2628 ownership documentation lands on main (currently tracked by PR #2629), or after the same source-root policy is independently confirmed on the base branch.