port(2P step 3c): stage python27.zip into the mobile sandbox

CPython opens the stdlib zip with its own stdio, so it needs a real path.
On the desktop res:// is a directory and globalize_path() is enough; in an
exported build res:// is inside the PCK, which nothing outside Godot reads.

  make_stdlib_zip.py now also writes <out>.sha256
  mtpython_stdlib_project copies python27.zip + .sha256 into project/
    (gitignored), and both export presets' include_filter lists them, so
    they enter the PCK — checked with --export-pack
  extension/src/python_stdlib.{h,cpp} (Metin2Python.stdlib_path in
    GDScript): reads the bytes out of the PCK, writes
    user://python27.zip.part, hashes the file as written against the
    shipped digest, then renames. A sandbox copy is reused only when it
    matches, so a first start killed mid-copy and a zip replaced by a new
    build both re-stage instead of feeding zipimport a torn file.
  PythonHost::SetDefaultStdLibPath / DefaultStdLibPath() answer with that
    path ($MT_PYTHON_STDLIB still wins). python_stdlib.cpp is the only unit
    that knows res:// / user://; port_platform stays godot-free.

Also fixes the Windows gate, which step 3b broke: without mtpython the
MinGW build compiled UserInterface/StdAfx.h (it includes ScriptLib/StdAfx.h,
as the original PCH does). port/CMakeLists.txt excludes that header and
PythonPackModule.cpp with ScriptLib, and platform/CMakeLists.txt excludes
platform/ScriptLib/ the same way.

Not done: on-device staging. The macOS test drives the mobile path with
force_stage=true, and nothing in the app boot calls it yet — the
interpreter only starts in the process with 2V0.

gates: python_stdlib_test.gd PASS (in-place path, staging, sha256, bytes
equal res://, no .part, ZIPReader finds encodings/__init__.py, no re-copy
on a second call, corrupted copy re-staged) · macOS ctest 27/27 ·
mingw + android + ios port_platform compile clean · port_map.py check 0
errors · key leak check 8/8 none.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/THIRD-PARTY.md

@@ -104,7 +104,10 @@ one via a 1-line shim header, see below).
   packs it into `<build>/python27.zip` with `tools/py_embed/make_stdlib_zip.py`,
   which is what the host puts on `sys.path` (batch 2P step 3). Entries are
   **stored, never deflated** — the `zlib` module is trimmed out above, so
-  `zipimport` has nothing to inflate with.
+  `zipimport` has nothing to inflate with. The zip and its `.sha256` are copied
+  into `project/` (gitignored) so the exporter packs them; on Android/iOS
+  `extension/src/python_stdlib.cpp` stages the zip out of the PCK into `user://`
+  and checks that digest, because CPython opens it with its own stdio.
 * **Why vendored:** 2.7 is end-of-life, so there is no package to fetch on the
   four target SDKs, and the build must keep working offline and on the
   cross-build machines. It is the version the 40250 scripts are written for