fix(scripts): materialize explicit E2E prompts (#38) + self-contained wrapper distribution check (#39)

[moonweave]

Summary

• Fixes bug: ORRO E2E passes a flowplan placeholder prompt that latest witnessd rejects #38 by materializing the declared E2E task into every executable role lane before proofrun, while preserving the step-by-step public ORRO smoke flow.
• Fixes bug: documented wrapper distribution check depends on host setuptools availability #39 by building the wrapper in a dedicated venv with setuptools explicitly absent, then using pip build isolation behind --allow-network to provision setuptools>=61.
• Keeps the wrapper boundary intact: witnessd executes, Depone verifies, and ORRO only exposes/tests the workflow. Wheel-content and non-engine assertions are unchanged.

Root causes

#38

scripts/orro_e2e_smoke.py passed the role-lane plan emitted by flowplan directly to proofrun. Its executable lane still used the generated Execute ORRO role ... placeholder, which latest witnessd correctly rejects fail-closed.

The smoke now replaces prompts only for may_execute=true lanes with its declared task, preserves non-executable prompts, and records flowplan_materializes_explicit_role_lane_prompts before calling proofrun.

#39

scripts/check_orro_wrapper_distribution.py invoked pip wheel --no-build-isolation, so success depended on the invoking interpreter already importing setuptools.build_meta.

The checker now creates a separate build venv, removes and probes for setuptools, requires explicit --allow-network, and lets PEP 517 build isolation provision the declared backend. Current docs and CI use the explicit flag; offline --self-test remains network-free.

RED evidence

#38 against witnessd 68e468d + Depone 46c55bd

RED_EXIT_CODE=2
"code": "ERR_ORRO_E2E_COMMAND_FAILED"
"stderr": "... ERR_ORRO_ROLE_LANE_PLACEHOLDER_PROMPT\n"
"message": "orro command failed: proofrun update README safely ... --role-lane-plan ..."

#39 from a fresh venv without setuptools

setuptools_absent=True
RED_EXIT_CODE=2
"code": "ERR_ORRO_WRAPPER_DISTRIBUTION_COMMAND_FAILED"
pip._vendor.pep517.wrappers.BackendUnavailable
ModuleNotFoundError: No module named 'setuptools'

Verification

• Full latest-pair E2E: exit 0 with lock match true for witnessd 68e468d61d16c2eef63cadbe28e757fdd8dcf483 and Depone 46c55bd4e137f6760ada848c84ebaee6c72b7ac7.
• New E2E check: flowplan_materializes_explicit_role_lane_prompts passed with one executable lane materialized before proofrun.
• Fresh outer no-setuptools regression: setuptools_absent=True, exit 0, build_venv_has_no_setuptools_before_build passed.
• Distribution boundary: wheel build/install and both console commands passed; contains_depone=false, contains_witnessd=false, contains_engine_logic=false.
• Repository contract, language/boundary/packaging/release checks, compilation, script self-tests, and git diff --check passed.

The witnessd placeholder guard was not weakened or modified. Neither witnessd nor Depone was changed.