cli: make --python optional, auto-detect from base when omitted

If --python is given it must match the base's detected Python version; if
omitted, the version is auto-detected (PYTHON_VERSION env, else apko.json) and
used for both wheel selection and the site-packages layout. Errors clearly when
the base version can't be determined and --python is unset. CI now relies on
auto-detection (drops --python). Adds resolveInterpreter tests and asserts the
auto-detected version flows into the image.

Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>

.github/workflows/pymage.yaml

@@ -21,8 +21,8 @@ jobs:
       run:
         shell: bash
     env:
+      # Python version is auto-detected from the base image (no --python flag).
       BASE: python:3.12-slim
-      PYTHON: python3.12
       REGISTRY: localhost:1338
     steps:
       - uses: actions/checkout@v6.0.2
@@ -104,7 +104,6 @@ jobs:
             --lock demo/requirements.txt \
             --find-links demo/wheelhouse \
             --source demo/src \
-            --python "$PYTHON" \
             --entrypoint python --entrypoint /app/app.py \
             --insecure \
             -t "$REGISTRY/demo:multi"
@@ -129,7 +128,7 @@ jobs:
         run: |
           set -euo pipefail
           common=(--base "$BASE" --platform linux/amd64,linux/arm64 --lock demo/requirements.txt \
-                  --find-links demo/wheelhouse --source demo/src --python "$PYTHON" \
+                  --find-links demo/wheelhouse --source demo/src \
                   --entrypoint python --entrypoint /app/app.py --insecure --push=false)
           d1=$(go run . build "${common[@]}" --print-digest)
           d2=$(go run . build "${common[@]}" --print-digest)
@@ -158,7 +157,7 @@ jobs:
         run: |
           set -euo pipefail
           common=(--base "$BASE" --platform linux/amd64 --lock demo/requirements.txt \
-                  --find-links demo/wheelhouse --source demo/src --python "$PYTHON" \
+                  --find-links demo/wheelhouse --source demo/src \
                   --entrypoint python --entrypoint /app/app.py --insecure)
           go run . build "${common[@]}" -t "$REGISTRY/demo:v1"