Make the pypy3 kernel build and run

[thomasjm]

The pypy3 kernel didn't evaluate, let alone build. nix flake check fails on main because of it,
via lspProbeEnvs:

(c.evaluateConfig { kernels.pypy3.enable = true; }).config.builtKernels.pypy3
→ error: mypy-1.17.1 not supported for interpreter pypy3.11

Four things were stacked up behind that:

1. Evaluation. A package unsupported on PyPy throws when its outPath is forced, even as a
   check input, and requiredPythonModules forces every element via lib.unique. Two chains hit
   it: ipython → stack-data → typeguard → mypy, and debugpy → django → objgraph.

2. C extensions that don't build on PyPy — brotlicffi, cmarkgfm, forbiddenfruit,
   msgspec, all test-suite-only. Rather than chase each, the kernel's interpreter gets
   doCheck = false across its package set. overridePythonAttrs re-runs buildPythonPackage, so
   check inputs are never added, which also subsumes 1. (overrideAttrs can't: it edits the
   derivation after those inputs have been evaluated.)

3. pyzmq builds and runs against cffi on PyPy, but nixpkgs only wires up the Cython path. Needs
   cffi/pycparser in both build-system and dependencies.

4. kernel.nix hardcoded "${python}/bin/python". A PyPy env has bin/pypy3 and no
   bin/python, so the generated kernel.json pointed at a nonexistent binary. Now uses
   python.interpreter.

Coverage

The sample environment and the kernel test both existed but were commented out — 7bad590 "Comment
pypy3 sample environment internals for now" (2024-10-10) and -- tests' ("pypy3", "pypy3") — so
build-sample-environments was passing on an empty environment and nothing exercised the kernel.
That's how it rotted unnoticed. Both are re-enabled here.

The test is a new minimal spec rather than the commented-out line, which reused the CPython
kernelSpec and would have dragged scipy, pylint, pyright and python-lsp-server onto PyPy. It
covers the kernel: expected fields, print("hi"), and platform.python_implementation() returning
PyPy.

Testing

Kernel executes code end to end, via a real Jupyter execute_request against the built spec:

KERNEL SAID: PyPy 3.11.13
2+2 = 4

Point 4 changes the CPython argv too (bin/python → bin/python3.13), checked the same way:
KERNEL SAID: CPython 3.13.12.

Sample environment builds, and its kernel.json now points at .../bin/pypy3.11 with display name
PyPy 7.3.20. Test suite compiles. nix flake check passes locally.

Note

Disabling checks across the whole PyPy package set is broad, and means PyPy packages ship untested.
Given how much of PyPy is broken in nixpkgs — four C extensions plus pyzmq in one small closure —
that seems the right trade, but say so if you'd rather have a narrow per-package list.

Split out of #98.