fix(scripts): sync structured compat matrix (#35) + deterministic e2e venv install (#36)

[moonweave]

Summary

• Fix bug: engine-lock updater leaves structured compatibility matrix stale #35 by updating the structured release compatibility matrix in the same updater invocation as the engine lock, release manifest, and Markdown matrix.
• Fix bug: ORRO E2E smoke cannot install wrapper in a fresh venv without setuptools #36 by creating an isolated wrapper venv, forcing the regression case to have no preinstalled setuptools, and using PEP 517 build isolation for the declared setuptools>=61 backend.
• Require explicit --allow-network authorization for build-dependency bootstrap and document/update the E2E CI invocation.

Bug #35 — structured compatibility matrix drift

Root cause

scripts/update_orro_engine_lock.py only treated docs/compatibility-matrix.md as the compatibility matrix. It never loaded or wrote release/compatibility-matrix.v0.json, and --self-test copied/asserted only the Markdown file.

RED

From an origin/main temporary fixture after a successful updater invocation with 111..., 222..., and 333...:

depone-n-witnessd-n None 9715ea278242ac920a721f6079aad6cebf49cd40 44eb26ef84a239d4d04570d763c549cee05839ee
orro-rc-locked-triplet af5b0d5180df1c1ae26a814a0f5a1b32527edb88 9715ea278242ac920a721f6079aad6cebf49cd40 44eb26ef84a239d4d04570d763c549cee05839ee
ORRO compatibility matrix violation: engine-lock witnessd commit must match depone-n-witnessd-n

Fix and verification

• Update depone-n-witnessd-n and orro-rc-locked-triplet while preserving all other structured metadata and boundary fields.
• Preserve existing immutable engine ref_name values unless replacement refs are explicitly supplied; the issue's reproduction command therefore remains checker-valid.
• Extend --self-test to copy/assert the structured matrix and run check_compatibility_matrix.py --metadata-only against the updated fixture.

GREEN fixture result:

ORRO engine-lock update helper: self-test pass
ORRO compatibility matrix: pass
engine_lock 1111111111111111111111111111111111111111 2222222222222222222222222222222222222222
release_manifest 3333333333333333333333333333333333333333 1111111111111111111111111111111111111111 2222222222222222222222222222222222222222
depone-n-witnessd-n 1111111111111111111111111111111111111111 2222222222222222222222222222222222222222
orro-rc-locked-triplet 3333333333333333333333333333333333333333 1111111111111111111111111111111111111111 2222222222222222222222222222222222222222
boundary {'approves_merge': False, 'raises_assurance': False, 'verifies_evidence': False, 'executes_commands': False}

Bug #36 — fresh venv lacks setuptools backend

Root cause

The E2E smoke used --no-build-isolation inside a new venv and relied on system_site_packages=True to expose setuptools.build_meta. Fresh Python environments, including Homebrew Python 3.13, do not guarantee setuptools is present.

RED (fresh venv)

setuptools_present= False
pip._vendor.pyproject_hooks._impl.BackendUnavailable: Cannot import 'setuptools.build_meta'
install_exit=2

Fix and verification

• Create the wrapper venv with system_site_packages=False.
• Remove any interpreter-bundled setuptools so the regression starts from the required no-setuptools state on every supported Python version.
• Install the editable wrapper with normal PEP 517 build isolation, allowing pip to satisfy pyproject.toml's declared backend requirement.
• Require --allow-network; pip may use its cache, otherwise a configured package index is required.

Focused full-smoke evidence:

decision pass
wrapper_venv_has_no_setuptools_before_install pass
wrapper_default_delegate_help_exit_zero pass
wrapper_default_delegate_help_reaches_orro pass
advise_returns_workstyle_decision pass
flowplan_writes_workflow_plan pass
proofrun_creates_run_dir pass
report_reaches_complete pass
scout_only_proofcheck_nonzero pass

Validation

• python3 scripts/update_orro_engine_lock.py --self-test
• temporary four-source updater fixture + python3 scripts/check_compatibility_matrix.py --metadata-only
• python3 scripts/orro_e2e_smoke.py --self-test
• full local E2E smoke with ../witnessd, pinned ../depone, and --allow-network
• python3 scripts/check_orro_repo_contract.py
• python3 scripts/check_no_bidi_controls.py
• python3 -m py_compile scripts/update_orro_engine_lock.py scripts/orro_e2e_smoke.py scripts/check_compatibility_matrix.py
• git diff --check origin/main...HEAD

Closes #35.
Closes #36.