Python tools repeatedly report missing entrypoints

Symptom: python.sh successfully installs a package and lists its executables, then immediately reports Installed tool has missing entrypoints; several large tools may be reinstalled on every bootstrap run.

Root cause: the validator treated every console script advertised by a Python package as part of the dotfiles contract and gave each script a 10-second cold start. Those scripts are not equivalent to selected tools. For example, mlx-lm advertises mlx_lm.evaluate, but that optional command imports lm-eval, which the base mlx-lm install intentionally does not include. Heavy ML commands could also exceed the cold-start bound and pass on the next run after their caches were warm.

Fix: update the dotfiles checkout and rerun the upgrade. Each pip*.txt declaration now names the command the dotfiles actually require with entry=. The installer validates only those commands, uses a 30-second Python CLI bound, and reports the exact package and command when validation fails.