fix(eval): bake python3-dev so Triton can find Python.h

[echobt]

Why

Live 1× BYOK harvest on prod failed again after #239 (424fb12a, pin sha256:996cb5f4…). gcc is present now, but Triton still dies compiling backends/nvidia/driver.c:

/opt/proof-eval-venv/lib/python3.12/site-packages/triton/backends/nvidia/driver.c:9:10: fatal error: Python.h: No such file or directory
#include <Python.h>

PROOF_EVAL_OK never printed, so the control plane stayed 503.

eval/Dockerfile.scoring installed build-essential + python3 / python3-pip / python3-venv but not python3-dev. The venv is CPython 3.12; Triton's host launcher compile needs Python.h from that version.

What changed

• eval/Dockerfile.scoring: keep build-essential and CC/CXX/CUDAHOSTCXX=gcc/g++ from fix(eval): install host C compiler for Triton on scoring image #239. Add python3-dev (Ubuntu 24.04 → 3.12 headers matching the venv). Bake-time checks: Python.h exists via sysconfig.get_path("include"), and gcc -E can preprocess #include <Python.h> against that path.
• publish-proof-eval-image: after the existing gcc check, assert Python.h is findable the same way (venv include path, not a hardcoded 3.12).
• No harness / harvest / BYOK / miner-autonomy change. Empty baked_proxies.json. No invented sha256.

Operator: republish + re-pin

This PR does not bump config/proof-pin.toml. Do not invent a digest.

Branch publish-proof-eval-image already built and pulled a scoring digest (run 34214757296): bake found /usr/include/python3.12/Python.h, gcc -E preprocess passed, harvest-PATH / gcc / Python.h / empty baked_proxies / selftest all green.

eval_image_digest = "sha256:d32676bf27a63cd721aa5572c8aa110c81652b10e8820e9d48928ed21d3ac1ce"

PROOF_GIT_SHA is a build-arg, so a merge-to-main republish will mint a new digest. Pin the digest from the post-merge job summary, not this branch one, unless you intentionally pin the branch image.

1. Merge (or let publish-proof-eval-image run on this cursor/** branch — it builds eval/Dockerfile.scoring).
2. Wait for publish-proof-eval-image on main to finish green.
3. Copy the scoring digest from the job summary (eval_image_digest = "sha256:…").
4. Bump eval_image_digest (and the pin comment / proof_git_sha) in config/proof-pin.toml to that published digest.
5. Until the pin moves, live harvest still boots sha256:996cb5f4… (gcc, no Python.h).

Empty digest stays fail-closed (503). A pin + can_score is not proof of scientific reproduction.

Greptile

• Greptile has reviewed this PR; findings are fixed or answered (5/5, no issues; T-Rex built the scoring image and confirmed Python.h preprocess)
• If the bot was silent, I commented @greptileai review

Test plan

• publish-proof-eval-image on this branch: digest pull, gcc present, CC=gcc, Python.h preprocess via venv include path (/usr/include/python3.12/Python.h), empty baked_proxies, proof-eval selftest
• After merge + pin bump: live 1× GPU score prints PROOF_EVAL_OK

Rust fmt/clippy/xtask gates are not in scope (Dockerfile + workflow only).

Risk

Live Proof scoring image only. No BASE_* rename, no emission/consensus change, no invented sha256. Next live rent still 503 until operators republish and re-pin.

Naming

I did not rename BASE_* environment variables, deployed host paths, GHCR package names, or base-*-v1 cryptographic domain tags.

  

[cursor]

@greptileai review

[greptile-apps]

Greptile Summary

Summary

• Adds the CPython development headers required by Triton's host launcher in the scoring image.
• Verifies that the evaluator virtual environment exposes Python.h and that GCC can preprocess an include of it during image construction and after pulling the published image digest.
• The image-level check completed successfully; this change is safe to merge.

Confidence Score: 5/5

Safe to merge: the built scoring image contains the evaluator virtual environment's CPython headers and can preprocess Python.h with GCC.

No defects were found. The changed image contract completed successfully in a built container.

Files Needing Attention: None.

T-Rex Logs

What T-Rex did

• Built the PR's scoring image from eval/Dockerfile.scoring with a 540-second bound and produced the image named trex-scoring-python-header-validation:pr-head.
• Validated that Python.h is present inside the built image and that GCC preprocessing of #include <Python.h> succeeds.
• Recorded the final outcomes as BUILD_EXIT_CODE: 0, CONTRACT_EXIT_CODE: 0, and RESULT: PASSED.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
eval/Dockerfile.scoring	Installs python3-dev and verifies the evaluator virtual environment's Python header is usable by GCC.
.github/workflows/publish-proof-eval-image.yml	Checks the published scoring image for the compiler and Python header preprocessing contract.

_{Reviews (2): Last reviewed commit: "fix(eval): bake python3-dev so triton ca..." | Re-trigger Greptile}