Problem

MongoDB currently has multiple independent Python selections:

• Bazel launches the wrapper hook with the hermetic `@py_host` Python toolchain, currently CPython 3.13.11.
• `bazel/wrapper_hook/install_modules.py` installs wrapper dependencies into `VIRTUAL_ENV` or the repository `python3-venv`, and invokes uv without explicitly selecting the Bazel Python interpreter.
• `pyproject.toml` and `uv.lock` allow Python `>=3.13,<4.0`, so a workstation venv can be created with Python 3.14 or later.

On a fresh Ubuntu checkout this can result in the Bazel wrapper running under Python 3.13 while uv installs dependencies into Python 3.14.5. Packages whose locked versions predate that interpreter may have no compatible wheel, causing uv to build from source. The wrapper passes through the host environment, including `CC` and `CXX`, so those source builds can use an unexpected compiler and violate the hermeticity users reasonably expect from a Bazel invocation such as `bazel build compiledb`.

This is distinct from SERVER-126500, which tracks the Poetry-to-uv migration, and SERVER-131267, which tracks outdated venv setup instructions.

Scope of Work

• Establish and document the canonical Python minor version for MongoDB's top-level Python tooling.
• Make the wrapper-hook uv bootstrap create or select its environment from Bazel's hermetic host Python, rather than relying on the system Python or an already-existing venv with an arbitrary minor version.
• Pass an explicit interpreter/environment selection to uv and define behavior for an existing venv with an incompatible Python version.
• Decide whether `requires-python` should be narrowed to the supported minor version and regenerate `uv.lock` if appropriate.
• Prevent host compiler settings from silently affecting dependency installation, or move this bootstrap path to a Bazel-native hermetic dependency installation mechanism where practical.
• Preserve Linux, macOS, Windows, Evergreen, and fresh-host behavior.

Acceptance Criteria

• A fresh Ubuntu 22.04/24.04 checkout invokes the wrapper dependency bootstrap with the canonical Bazel Python version.
• The wrapper does not silently select Python 3.14+ when the repository's canonical version is 3.13.
• `CC`, `CXX`, and related host build settings cannot unexpectedly control dependency builds.
• The behavior is covered by unit/integration tests, including a missing venv and an incompatible existing venv.
• The setup and Python-version policy are documented.