fix: validate an OpenHands setup before using it

[tdene]

The reuse gate for a pre-existing OpenHands setup was 'the venv interpreter file exists', which conflates two very different states with a healthy environment: an interrupted build (a python binary with no packages behind it) and a venv whose packages an episode has since downgraded (episodes run pip inside the sandbox).

Attempting to use pre-existing venv's in either case causes all subsequent episodes to fail and mistakenly return 0 reward.

Nothing ever rebuilds the env on main because the gate always passes.

[tdene]

/ok to test 406b66a

[tdene]

/claude review

[claude]

NOTE: the probe's version floors (jinja2>=3.1.3, pyjwt>=2.9, sqlalchemy>=2.0.40, flask>=2.2) are decoupled from what a rebuild actually installs. openhands.sh never pins these — they come from whatever OpenHands' poetry lock resolves. If the lockfile ever resolves any of them below a floor, _existing_setup_is_reusable returns False on every server startup, so the reuse fast-path is silently disabled and each process pays a full rebuild (which resolves the same sub-floor versions and would fail the probe again next time). No infinite loop (setup() doesn't re-probe after rebuild) and no data corruption — the cost is a permanent, silent loss of the reuse optimization. If these floors encode a known-bad OpenHands version, consider pinning them in openhands.sh alongside the wandb/datasets install so the rebuild actually satisfies what the probe demands.

[claude]

SHIP — startup-only reuse gate, well-tested, off the scoring/async hot paths.

This adds a runtime probe to the OpenHands harness setup() so a stale .venv (missing wandb, or with dep versions below required floors) is rebuilt instead of reused — previously a corpse venv would be republished and fail every subsequent episode after the agent had done its real work. Good defensive change.

Blast-radius check: _existing_setup_is_reusable/_probe_openhands_venv run once per server process in model_post_init → setup(), under file_lock — not per episode, not on verify() or any score/reward path. Worst case is a wasted rebuild at startup, never silent score corruption or an async hang. subprocess_run here is the same synchronous helper used elsewhere in this file's setup paths. The empty-stderr fallback (" ".join(...[-1:]) → "" → f"exit code {...}") is handled. Tests cover the three-way gate (no setup / healthy / failing probe) and the stderr-reporting path.

One non-blocking NOTE inline: the probe's version floors are decoupled from what a rebuild installs — if OpenHands' lock ever resolves a probed package below a floor, the reuse fast-path silently disables itself on every startup (permanent rebuild cost, no corruption). Consider pinning those floors in openhands.sh if they encode a known-bad version.

[claude]

NOTE: the probe's version floors (jinja2>=3.1.3, pyjwt>=2.9, sqlalchemy>=2.0.40, flask>=2.2) are decoupled from what a rebuild actually installs. openhands.sh never pins these — they come from whatever OpenHands' poetry lock resolves. If the lockfile ever resolves any of them below a floor, _existing_setup_is_reusable returns False on every server startup, so the reuse fast-path is silently disabled and each process pays a full rebuild (which then resolves the same sub-floor versions and would fail the probe again). No infinite loop (setup() doesn't re-probe after rebuild) and no data corruption — the cost is a permanent, silent loss of the reuse optimization. If these floors encode a known-bad OpenHands version, consider pinning them in openhands.sh alongside the wandb/datasets install so the rebuild actually satisfies what the probe demands.