build: mise.toml provisions banned runtimes (python, denojs) and a Python-only toolchain #832

Found while pinning zig in mise.toml for #813, and deliberately not
folded into that change — it has its own blast radius.

mise.toml provisions two runtimes that are banned estate-wide:

python = "latest"
denojs = "latest"

Estate doctrine: bun is the runtime; python, deno, rescript and typescript
are banned. These two lines install the banned runtimes for every developer
who runs mise install in this repository.

It is not only those two lines. The file carries a whole Python toolchain
around them:

• [tools]: pip, black, isort, ruff, pytest — all Python-only
• [env]: PYTHONDONTWRITEBYTECODE, PYTHONUNBUFFERED
• [alias]: entries invoking npm, go, ruff, black, pytest, jest,
  vitest

So removing the two runtime lines alone would leave a set of tools that cannot
run, which is a different kind of wrong rather than a fix.

Acceptance criteria

• python and denojs are gone from [tools].
• The Python-only tools that depended on them (pip, black, isort,
  ruff, pytest) are removed too, or each one that is kept has a stated
  reason naming what in this repository still needs it.
• The PYTHON* entries in [env] are removed if nothing remains that
  reads them.
• [alias] entries invoking removed tools are removed or repointed.
• Measured, not assumed: mise install on a clean checkout succeeds
  afterwards, and every just recipe that previously resolved a tool
  through mise still resolves it. Name the recipes checked.
• A check exists that a banned runtime cannot be reintroduced to
  mise.toml silently — the estate already has language-ban tooling
  (language-blockers.yml); prefer extending it over a new bespoke grep.

⚠ Before deleting any detector or probe in the course of this: a probe can be
the enforcement teeth of a ban, and removing it makes the ban stop firing
while the repository goes green. Read a probe's consumer before removing it.