fix(sdk): use PATH-resolved python binary for exec_python

The hardcoded /app/.venv/bin/python path was specific to the old
repo-built sandbox image. Community sandbox images install Python at
standard system paths, so resolve via PATH instead. Update e2e policy
tests and docs to use /usr/bin/python* glob for binary matching.

e2e/python/test_sandbox_policy.py

@@ -51,7 +51,7 @@ def _policy_for_python_proxy_tests() -> sandbox_pb2.SandboxPolicy:
                 endpoints=[
                     sandbox_pb2.NetworkEndpoint(host="api.openai.com", port=443)
                 ],
-                binaries=[sandbox_pb2.NetworkBinary(path="/app/.venv/bin/python")],
+                binaries=[sandbox_pb2.NetworkBinary(path="/usr/bin/python*")],
             )
         },
     )
@@ -373,7 +373,7 @@ def test_l4_binary_restricted_denies_wrong_binary(
     """L4-3: Policy restricted to specific binary denies others.
 
     Policy allows /usr/bin/curl -> api.anthropic.com:443.
-    Python (exec_python uses /app/.venv/bin/python) should be denied.
+    Python (exec_python uses python) should be denied.
     """
     policy = _base_policy(
         network_policies={
@@ -438,7 +438,7 @@ def test_l4_cross_policy_denied(
                 endpoints=[
                     sandbox_pb2.NetworkEndpoint(host="api.anthropic.com", port=443),
                 ],
-                binaries=[sandbox_pb2.NetworkBinary(path="/app/.venv/bin/python")],
+                binaries=[sandbox_pb2.NetworkBinary(path="/usr/bin/python*")],
             ),
             "other": sandbox_pb2.NetworkPolicyRule(
                 name="other",

e2e/python/test_sandbox_venv.py

@@ -37,12 +37,6 @@ def test_sandbox_venv_in_path(
         assert "/sandbox/.venv/bin" in path_dirs, (
             f"Expected /sandbox/.venv/bin in PATH, got: {result.stdout.strip()}"
         )
-        # /sandbox/.venv/bin must come before /app/.venv/bin
-        sandbox_idx = path_dirs.index("/sandbox/.venv/bin")
-        app_idx = path_dirs.index("/app/.venv/bin")
-        assert sandbox_idx < app_idx, (
-            "/sandbox/.venv/bin must precede /app/.venv/bin in PATH"
-        )
 
 
 def test_pip_install_in_sandbox(