fix(code-runtime-python): complete the experimental move across configs and docs

The review's move-follow-ups: the Windows test exclude now points at
packages/experimental/code-runtime-python (the constructor throws by design on
Windows, so the suite must stay excluded); the invariant companion and
@module annotations use the new npm name; the truncation marker text and
tmpdir prefix stay as-is (tests anchor them); the package JSDoc and READMEs no
longer call the private experimental backend 'published'/'shipped'; the
code-runtime README row describes the package as protocol AND runtime; the
fd-3 note records the package's experimental location.

packages/experimental/code-runtime-python/src/index.ts

@@ -9,7 +9,7 @@
  * the CPython subprocess. The protocol's host-side codec and hostile-frame
  * validators are re-exported so every consumer of the wire shares one
  * vocabulary.
- * @module @deepseek-ai/dsh-code-runtime-python
+ * @module @deepseek-ai/dsh-experimental-code-runtime-python
  */
 
 import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
@@ -680,7 +680,7 @@ interface LiveRun {
 }
 
 /**
- * The shipped {@link CodeRuntime} backend registering as `codeRuntime`. Every
+ * The experimental {@link CodeRuntime} backend (private, not released) registering as `codeRuntime`. Every
  * cap is validated config; every long-running operation honors the request's
  * `AbortSignal`; every disposer awaits child-process exit.
  */

packages/experimental/code-runtime-python/src/protocol.ts

@@ -3,7 +3,7 @@
  * travel on the child's fd 3 (one JSON object per line), leaving stdout/stderr free for the
  * program's own output. Host treats every inbound frame as hostile because model code can post
  * anything through the same fd; the Python bootstrap trusts host replies.
- * @module @deepseek-ai/dsh-code-runtime-python/src/protocol
+ * @module @deepseek-ai/dsh-experimental-code-runtime-python/src/protocol
  */
 
 /**