fix(go/docker): python3 + pytest in the runtime image; OpenRouter-only runtime note

Battle-testing the image surfaced two gaps: Python repos cannot produce
test evidence in-container (no pytest), which fails evidence-based
verification of correct work; and OpenRouter-only deployments inherit the
compose default SWE_DEFAULT_RUNTIME=claude_code, silently degrading
advisory/verification roles that then have no credential. Adds the test
tooling to the image and documents the runtime setting.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: AbirAbbas

go/Dockerfile

@@ -69,7 +69,11 @@ ENV DEBIAN_FRONTEND=noninteractive
 # OpenCode CLI (open_code runtime), Codex CLI (codex runtime), Claude Code CLI
 # (claude_code runtime).
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git curl ca-certificates openssh-client jq nodejs npm && \
+    git curl ca-certificates openssh-client jq nodejs npm \
+    # Python test tooling: repos under build are frequently Python, and both
+    # the verifier role and evidence-based audits need a runnable pytest —
+    # without it, Python-repo verification is impossible in this image.
+    python3 python3-pytest && \
     # GitHub CLI
     curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
         | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \

go/docs/pro-engine.md

@@ -51,6 +51,13 @@ the standard pipeline, so the deliverables are unchanged.
 The engine inherits `OPENROUTER_API_KEY` and the control-plane coordinates
 (`AGENTFIELD_SERVER`, `AGENTFIELD_API_KEY`) from the node's environment.
 
+**OpenRouter-only deployments:** the compose files default
+`SWE_DEFAULT_RUNTIME` to `claude_code`. The engine itself runs on OpenRouter
+regardless, but the node's advisory/verification roles follow
+`SWE_DEFAULT_RUNTIME` — with no Anthropic credential they fail and degrade to
+accept-with-debt fallbacks. If OpenRouter is your only credential, set
+`SWE_DEFAULT_RUNTIME=open_code` so every role uses the same provider.
+
 ## Rollout
 
 The pro engine is an opt-in preview. It is planned to become the default in a