Fix Poetry env discovery falling past its env (#671, #866, #1023) (#1259)

* Start fix for #671, #866, #1023

Assisted-by: Claude Code:claude-opus-5-5

* Add failing tests for Poetry env discovery

Poetry picks one env per project, but discovery lets a stray ./venv
win under virtualenvs.create = false (#671), falls back to the OS
Python on a fresh checkout (#1023), and re-admits an unrelated active
shell env when {data-dir} gives several roots (#866). These tests pin
the expected behaviour; the fix follows.

Assisted-by: Claude Code:claude-opus-5-5

* Resolve a Poetry project's env as one answer

Agent, hosted and vendored scans now use exactly the env Poetry
itself picks for a project, and stop there:

- With virtualenvs.create = false, a stray ./venv (or a ./.venv
  that in-project = false rules out) is no longer patched in place
  of the system env Poetry installed into (#671).
- A fresh Poetry checkout with no env yet no longer falls back to
  the OS Python, so agent mode leaves system files alone and
  vendored mode no longer fails on system-only packages (#1023).
- A poetry env use record in any {data-dir} root now keeps an
  unrelated active VIRTUAL_ENV / conda env out of the scan (#866).

A [tool.poetry-...] plugin table alone no longer makes a project
Poetry's.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko