fix(tether): resolve a working Python 3 instead of hardcoding python3

[AmirF194]

Root cause

Every python3 call site in lib.sh, tether.sh, and
hooks/tether-notify.sh invokes the interpreter directly with no
exit-code check. That is deliberate for this file (it runs without
set -e), so the assumption baked into every call site is that
python3 either runs or is entirely absent from PATH.

On Windows/Git Bash that assumption is wrong: python3 is commonly
the Microsoft Store App Installer redirector shim. It sits on PATH,
so command -v python3 succeeds, but it exits non-zero with no
output on every real invocation. Every helper that shells out to it
(t_now_iso, t_state_get/t_state_set, t_duration_to_expiry,
and about 15 others) silently returns an empty string instead of a
real value, and the caller limps forward on that empty data instead
of stopping.

Fix

Added t_python (lib.sh), which resolves and memoizes a Python 3
that actually executes: tries $E2A_PYTHON, then python3, then
python, verifying each candidate by running it rather than just
locating it on PATH. All ~20 call sites now go through it. When no
candidate works, t_python prints a clear diagnostic to stderr
instead of failing silently.

Verification

• Reproduced the reported shim in a clean Docker container (a fake
  python3 that exits 49 with no output) against unmodified main
  (9d7d86f): t_now_iso returned empty and t_state_set wrote no
  state file, silently. The new _selftest check covering this,
  run against the same container, fails on main and passes on
  this branch, both with the fallback python present and with no
  working interpreter anywhere (loud stderr diagnostic instead).
• Full tether.sh _selftest (this repo's test suite for the skill,
  run by the tether CI job) green on the branch.
• This repo's package job gates (node --test plugin contract
  tests, node scripts/validate-plugin.mjs) green after bumping the
  e2a-labs plugin version in plugin.meta.json per its version-bump
  check.
• Not verified: the literal Windows/Git Bash environment (none
  available here). The Docker repro reproduces the shim's exact
  observable behavior (on PATH, exits non-zero, no output), not the
  OS itself.

This covers item 1 of #367 only (the interpreter-resolution fix);
items 2-5 of that issue are separate onboarding/UX proposals already
partially superseded by the CLI rewrite in #369, out of scope here.

Refs #367