chore: lock the repository Pyright toolchain (#3678)

# Summary

This is part of a series to reduce the SDK's dependency surface and make
contributor tooling more predictable.

- Manage Microsoft's Pyright package with an exact version and a
checked-in pnpm lockfile, keeping the existing type-checker version.
- Remove the Python Pyright wrapper and its `nodeenv` dependency. Lint
runs the repository-local tool and fails with setup instructions when it
is missing.
- Make bootstrap and CI install the pinned toolchain explicitly, with
frozen dependencies, an eight-day update policy, and lifecycle scripts
disabled. Packages without publication dates are rejected too.
- Keep Node tooling out of the SDK runtime and wheel build requirements.

This supersedes the Pyright/toolchain portion of #3116 on top of the
merged uv migration. Locking the existing Steady mock-server invocation
is a separate follow-up.