fix(provenance): record traced child's Python identity, not roar's host

Friction-journal feedback on #108: after the cross-Python fixes,
`roar show @N` reports `Environment: ... Python 3.13.x` for jobs whose
command was system `python3` (3.12). The Python identity in job
metadata was being captured from `platform.python_version()` in roar's
own host process (`runtime_collector.collect`), not from the traced
child. Right at the seam roar is selling reproducibility on.

Captures `python_version` + `python_implementation` from
`platform.{python_version,python_implementation}()` *inside* the traced
process in `tracker.write_log`, threads them through the
`PythonInjectData` model, and has `runtime_collector` prefer the
traced values (falling back to host values when the inject log is
missing the fields, e.g. older logs).

Also: stderr remediation in `sitecustomize.py` now suggests
`uv tool install --python pythonX.Y roar-cli --reinstall` instead of
`--force`. Same effect, accurate user-facing semantics, less alarming.

Tests:
- `test_runtime_tracker_writes_expected_log_payload` asserts
  `python_version` (with at least 2 dots, e.g. "3.12.3") and a
  non-empty `python_implementation`.
- 968 unit tests passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chrisgeyertreqs

roar/core/models/provenance.py

@@ -65,6 +65,8 @@ class PythonInjectData(RoarBaseModel):
     shared_libs: list[str] = Field(default_factory=list)
     used_packages: dict[str, str | None] = Field(default_factory=dict)
     installed_packages: dict[str, str] = Field(default_factory=dict)
+    python_version: str = ""
+    python_implementation: str = ""
 
     @computed_field  # type: ignore[prop-decorator]
     @property

roar/execution/provenance/runtime_collector.py

@@ -195,8 +195,14 @@ def collect(
                 "machine": platform.machine(),
             },
             python={
-                "version": platform.python_version(),
-                "implementation": platform.python_implementation(),
+                # Prefer the traced child's Python (captured via the inject log)
+                # over roar-cli's host Python — when they differ (cross-Python
+                # roar run), the host value would misrepresent which Python
+                # actually ran the user's code.
+                "version": python_data.python_version or platform.python_version(),
+                "implementation": (
+                    python_data.python_implementation or platform.python_implementation()
+                ),
             },
             env_vars=python_data.env_reads,
             container=container_info,

roar/execution/runtime/inject/sitecustomize.py

@@ -55,7 +55,7 @@ def _append_roar_runtime_pythonpath() -> None:
             f"    - Install roar in this Python: pip install roar-cli\n"
             f"    - Reinstall roar-cli under matching Python:\n"
             f"        uv tool install --python python{_running_abi[0]}.{_running_abi[1]} "
-            f"roar-cli --force\n"
+            f"roar-cli --reinstall\n"
         )
         _runtime_import_controller.disable_backend_dispatch()
     else:

roar/execution/runtime/inject/tracker.py

@@ -6,6 +6,7 @@
 import contextlib
 import json
 import os
+import platform
 import sys
 from collections.abc import Mapping, MutableMapping, Sequence
 from typing import Any, Protocol, cast
@@ -203,6 +204,8 @@ def write_log(self) -> None:
             "argv": sys.argv,
             "installed_packages": installed_packages,
             "used_packages": used_packages,
+            "python_version": platform.python_version(),
+            "python_implementation": platform.python_implementation(),
         }
         with self._real_open(self._log_file, "w") as handle:
             json.dump(data, handle)

tests/execution/runtime/test_runtime_tracker.py

@@ -37,6 +37,11 @@ def handle_import(self, module_name: str, module) -> None:
     assert str(data_path.resolve()) in payload["opened_files"]
     assert payload["env_reads"]["VIRTUAL_ENV"] == "/tmp/venv"
     assert payload["virtual_env"] == "/tmp/venv"
+    # Python identity from the *traced* process — consumed by runtime_collector
+    # to populate job metadata. Critical when roar's host Python and the traced
+    # Python differ (cross-Python `roar run`).
+    assert payload["python_version"].count(".") >= 2  # e.g. "3.12.3"
+    assert payload["python_implementation"]  # e.g. "CPython"
 
 
 def test_runtime_tracker_excludes_roar_runtime_pythonpath_modules(tmp_path) -> None: