fix: soilweb links — cokey-based URL mapping + deterministic ordering - #373

Regenerated against the pinned CI DB image (ghcr.io/techmatters/soil-id-db:2026-06-23)
inside a GDAL-capable container. 27 snapshots updated (16 US, 11 global), 3 unchanged.
Verified deterministic: a second run without --snapshot-update passes clean (30/30).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Regenerating the unit-test output snapshots was a fiddly manual process:
GDAL won't build under uv/pip on macOS, and the snapshots are
environment-sensitive, so they must be produced against an interpreter
matching CI and the exact pinned soil-id-db image CI uses (not the local
:latest terraso-backend runs).

Automate it:
- scripts/snapshot-runner.Dockerfile: CI-faithful runner image
  (Ubuntu + ubuntugis + Python 3.13 + pinned requirements; GDAL 3.11.4).
- scripts/run_in_container.sh: provisions the pinned DB on a private network
  (no host port, so it can't collide with a running terraso-backend on 5432)
  and runs given make targets in the runner with the repo bind-mounted.
- scripts/regen_snapshots.sh: regenerate + verify determinism + git status.
- Makefile: test / test_unit / test_update_unit_snapshots auto-detect when
  GDAL isn't importable and transparently re-run themselves in the container
  (NATIVE=1 forces native and prevents recursion), so the same make command
  works on macOS and CI. Adds a regen_snapshots target.
- Document the workflow in README.md and scripts/README.md.

Verified: make test_update_unit_snapshots on macOS containerizes and
reproduces the committed snapshots byte-for-byte, and the verify pass confirms
determinism.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…lity

The auto-detect guard checked only whether *some* python3 could import GDAL.
On macOS a Homebrew python3 (brew install gdal) imports GDAL but has no pytest,
while the uv venv has pytest but no GDAL — so `make test_update_unit_snapshots`
took the native path and then failed on a missing pytest, instead of
containerizing.

Gate the native path on the interpreter having pytest AND the *pinned* GDAL
version (requirements.txt), run tests via `$(PYTHON) -m pytest` so the check and
execution share an interpreter, and expose PYTHON as an override. This also
closes a correctness hole: snapshots are GDAL-version-sensitive, so a native
GDAL of a different version must not silently produce snapshots that disagree
with CI — it's routed to the pinned-version container instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>