py user story: restore `bazel run` once rules_py ships the hermetic_launcher fix

[gregmagolan]

Background

The py preset's user story (user_stories/py.md) builds and tests the sample (aspect build / aspect test) but intentionally does not bazel run the py_binary, unlike every other language's story which runs its sample. This is a workaround.

Why

aspect_rules_py (2.0.0-alpha.3) uses the hermetic_launcher stub for py_binary. Running a py_binary via bazel run aborts with ERROR: execve failed with errno 2: under bazel run the launcher gets a relative argv[0], cwd inside the runfiles tree, and no RUNFILES_DIR, so <argv[0]>.runfiles discovery fails and the venv-python rlocation never resolves.

• Upstream launcher fix: fix(runfiles): resolve real exe path when argv[0] is relative (fixes bazel run) hermeticbuild/hermetic-launcher#44
• rules_py tracking + remedy: test(e2e): reproduce py_binary execve failure under bazel run (runfiles discovery) rules_py#1113

bazel test is unaffected (it sets RUNFILES_DIR), which is why the story uses build+test.

Action (once the launcher fix is released)

1. Wait for hermetic-launcher#44 to land + release, then for rules_py to bump hermetic_launcher and cut a release including it.
2. Bump aspect_rules_py in template/MODULE.bazel to that release.
3. Revert the py.md workaround so the story runs the sample, e.g.:

   output=$(bazel run //hello/py:hello)
   echo "$output" | grep -q "Hello, world!"

   and the cmd/greet section's bazel run //cmd/greet:main check.

Verify

sh user_stories/py.md passes end-to-end with the bazel run steps restored, and the py + kitchen-sink preset CI legs stay green.