fix(py): avoid dirname in console scripts

[tamird]

Generated console-script wrappers resolve their sibling interpreter by running dirname. A caller can find the wrapper through a PATH containing only the venv bin directory, but the wrapper cannot find dirname, expands its interpreter path to /python, and fails before the entry point runs.

Resolve the sibling interpreter with POSIX shell parameter expansion. The wrapper stays relocatable and keeps the existing dotted-entry-point dispatch without an ambient tool dependency.

The console-script runtime test now invokes a generated cowsay wrapper with PATH limited to its venv bin directory. It fails on the previous wrapper with dirname not found and /python missing, and passes with this change.

[github-actions]

py_binary startup benchmark

Version	Mean (ms)	Median (ms)	± stddev	vs BCR	vs main	Build (s)
BCR 1.11.7 (baseline)	186.298	185.086	±7.033	—	—	41.11
HEAD main	58.906	58.844	±0.545	-68.4%	—	9.39
This PR	60.021	59.169	±4.176	-67.8%	+1.9%	6.61

Measured with hyperfine --warmup 5 --runs 50 on Linux
Gate: PR vs HEAD main (threshold: 10%). BCR is shown only as a historical baseline.
Build time: cold bazel build //:bench with isolated output base, no disk cache.

sys.path quality

Version	sys.path entries	distinct site-packages roots	duplicate realpaths
BCR 1.11.7 (baseline)	6	1	0
HEAD main	7	2	0
This PR	7	2	0

sys.path quality measured by bench_syspath inside the assembled venv. Duplicate realpaths indicate symlink redundancy; many distinct site-packages roots suggest an inefficient venv layout.

✅ No regression detected (PR is +1.9% vs HEAD main)