py user story: restore `bazel run` once rules_py ships the hermetic_launcher fix

## Background

The `py` preset's user story (`user_stories/py.md`) builds and tests the sample (`aspect build` / `aspect test`) but intentionally does **not** `bazel run` the `py_binary`, unlike every other language's story which runs its sample. This is a workaround.

## Why

`aspect_rules_py` (2.0.0-alpha.3) uses the `hermetic_launcher` stub for `py_binary`. Running a `py_binary` via `bazel run` aborts with `ERROR: execve failed with errno 2`: under `bazel run` the launcher gets a relative `argv[0]`, cwd inside the runfiles tree, and no `RUNFILES_DIR`, so `.runfiles` discovery fails and the venv-python rlocation never resolves.

- Upstream launcher fix: hermeticbuild/hermetic-launcher#44
- rules_py tracking + remedy: aspect-build/rules_py#1113

`bazel test` is unaffected (it sets `RUNFILES_DIR`), which is why the story uses build+test.

## Action (once the launcher fix is released)

1. Wait for hermetic-launcher#44 to land + release, then for rules_py to bump `hermetic_launcher` and cut a release including it.
2. Bump `aspect_rules_py` in `template/MODULE.bazel` to that release.
3. Revert the `py.md` workaround so the story runs the sample, e.g.:
```sh
output=$(bazel run //hello/py:hello)
echo "$output" | grep -q "Hello, world!"
```
and the `cmd/greet` section's `bazel run //cmd/greet:main` check.

## Verify

`sh user_stories/py.md` passes end-to-end with the `bazel run` steps restored, and the py + kitchen-sink preset CI legs stay green.

Start by reading user_stories/py.md and template/MODULE.bazel, then check the release status of hermetic-launcher#44 and aspect-build/rules_py#1113. After the fixed rules_py release is available, restore the bazel run checks for //hello/py:hello and //cmd/greet:main, bump the dependency, and run sh user_stories/py.md plus the py and kitchen-sink CI legs.

Written by the indexing model from the issue text.