test(tooling): T-1257 — reach called by name, and one Python

Two failures T-1261 found and fixed by hand, left unguarded. They now fail
the conformance gate:

- (8) An interpreter-prefixed invocation — `python -m tooling`,
  `python3 -m tooling`, `.venv/bin/reach` — anywhere in the Makefile, the
  hooks, .claude or docs. One such line silently forks the PATH guarantee.
  Lines that FORBID the pattern are exempt, since docs/DEVOPS.md states the
  rule in those words and a check that flags its own documentation gets muted.
- (9) The installed reach (read from its shebang) and the .venv the gate
  tests run in must be the same Python minor version, and it must be the one
  the Makefile pins. uv once installed reach on 3.11 against a 3.14 venv, so
  the tests were proving nothing about the interpreter the hooks run.

Both proven to fail: an appended `python3 -m tooling.main` make target is
caught at its line, and a fake `reach` with a 3.12 shebang first on PATH
trips both version comparisons. The invariant list in the docstring now
covers all nine, not the first five.

Also: the canvas-version units ran under system python3 while every other
gate test uses $(VENV_PY). Now they match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -304,7 +304,7 @@ test-tooling:
 		{ echo "  FAIL: character decisions — log follows:"; cat .cache/test-tooling-character.log; exit 1; }
 	@echo "  [test-tooling] canvas-generation version gate units (T-1242)..."
 	@mkdir -p .cache
-	@python3 tooling/test_canvas_version_check.py 2> .cache/test-tooling-canvas-version.log || \
+	@$(VENV_PY) tooling/test_canvas_version_check.py 2> .cache/test-tooling-canvas-version.log || \
 		{ echo "  FAIL: canvas version gate units — log follows:"; cat .cache/test-tooling-canvas-version.log; exit 1; }
 	@echo "  [test-tooling] reach lazy domain registration (T-1260)..."
 	@mkdir -p .cache