Stop the version check from silently not running

[fedorov]

The bug

python scripts/check_version.py appeared in SKILL.md and seven guides. On a bare
Homebrew macOS install there is no python, so the check fails with command not found
— a non-fatal shell error, easily read as noise, leaving the version check skipped
entirely.

python3 is not the fix: it is absent inside a Windows virtual environment, and on
Windows either name can resolve to a Microsoft Store alias stub that opens the Store
instead of running the script. No interpreter name is portable. That is the same defect
TestInstallCommands already pins for pip — an ambiguous name in front of the thing
you meant to run — so this extends an existing rule rather than adding a new one.

Why it matters

The failure it guards against is silent. Identifier values are renormalised between
idc-index releases while the reported IDC data version is not: 0.12.3 and 0.12.5 both
serve v24, but spell the Pan-Cancer nuclei segmentations Pan-Cancer-Nuclei-Seg-DICOM
and pan_cancer_nuclei_seg_dicom respectively. A query written against the wrong one
returns zero rows rather than raising, so it reads as "no such data" instead of "your
index is stale". get_idc_version() cannot tell them apart — the package version is the
only signal.

Found while reviewing IDC-Tutorials#112:
the review ran against a stale 0.12.3, got zero rows, and reported a working notebook as
broken. check_version.py was correctly designed and correctly pinned at 0.12.5 — it was
simply never reached.

The fix

Two layers, because prose alone is skippable:

1. The guides name the script by path, with no interpreter prefix, and tell the caller
   to use the interpreter that will run idc-index and to confirm the
   meets pinned minimum line rather than assume the command ran.
2. The setup snippet repeats the check in Python, right after import idc_index. This
   is the part that actually closes the hole: it cannot be skipped and cannot fail to
   launch, because the interpreter that imports the package is by construction the one
   that will query.

Also here:

• Stale-index output states the consequence (zero rows, not an error) instead of only the
  version gap, which reads as housekeeping.
• Access-path gate step 2 asks whether idc-index is "installed and current". 1.8.0
  demoted this from a standalone CRITICAL — run this FIRST step into the routing list,
  where an agent that already has idc-index reads it as a satisfied precondition.
• Version pins bumped 1.8.1 → 1.8.3. 1.8.2 bumped the CHANGELOG and neither pin; they
  agreed with each other, so the sync tests passed while every checkout reported
  "Skill 1.8.2 available (you have 1.8.1)".

Tests

Two regression tests, both verified to fail when the defect is reintroduced:

• TestInterpreterCommands — scans SKILL.md, references/*.md and scripts/*.py for an
  interpreter name in front of scripts/. Deliberately skips CHANGELOG.md, whose
  descriptive mention of the old command would otherwise trip it.
• test_skill_version_matches_changelog — pins SKILL_VERSION to the newest CHANGELOG
  heading, the gap that let 1.8.2 ship desynced.

Offline suite green (35 passed). The new Python guard was checked against real installs:
raises on 0.12.3, passes and prints v24 on 0.12.5, and tolerates 0.13.0rc1,
0.12.5.post1 and short 1.0.

Two things for the maintainer

• SKILL.md is now at exactly 500/500 lines. It was already at 495, and SYNC.md:42
  records the 500-line cap as a vendoring contract, so I moved the detailed rationale into
  references/cli_guide.md rather than raise it. TestLineBudget passes, but there is
  zero headroom — you may prefer to rebalance something out of SKILL.md.
• Unrelated, same class of problem: the repo's own .venv has idc-index 0.12.2, below
  the pinned 0.12.5, so tests/test_snippets.py validates against an index two releases
  behind what the skill requires. CI is unaffected — tests/requirements-test.txt pins
  0.12.5.

🤖 Generated with Claude Code