He doesn't need to prove it to Alice.  Alice doesn't care.  He needs to prove it to every full node on the entire bitcoin network.  Each and every node will verify that Bob fulfilled the necessary requirements when they receive the transaction, and will refuse to relay the transaction to any peers if he didn't.  Each and every solo miner, or mining pool, will verify that Bob fulfilled the necessary requirement before they add the transaction to a block they are mining, and will refuse to add it if he didn't. Each and every node on the network will verify that Bob fulfilled the requirements when they receive the mined block and will refuse to relay the block or add the block to their own blockchain if he didn't.  If Bob doesn't fulfill the requirements (in the ScriptSig of transaction B), then Transaction B will never be able to leave Bob's wallet/client and get on to the bitcoin network.

In the ScriptSig of transaction B.  Bob fulfills the requirements in order to prove that he is authorized to spend the previous output when he sets up the requirement for the next receiver to be able to spend it.

ScriptSig
The ScriptSig is the digital signature created by the SENDERS private key.  In Transaction A the ScriptSig is a digital signature created by signing a hash of the simplified tx* with Alice's private key.   It also contains a copy of Alice's public key so the signature can be verified (because Satoshi likely didn't know about ECDSA public key recovery).

The ScriptSig (one per input) is used to validate the transaction.   This is how we know Alice (well someone who has access to Alice's private key), not Bob created the transaction.  In your diagram, anyone could steal Alice's coins by simply creating a tx sending them to their address (pubkeyhash).

scriptPubKey
You have it written the scriptPubKey is a hash of the ScriptPubKey.  In actuality in most tx (https://en.bitcoin.it/wiki/Transactions#Pay-to-PubkeyHash) we are paying to the PubKeyHash so the PubKey isn't in the output.  The PubKeyHash is.  The PubKey is included in the input of a subsequent tx.

Simple version:
Input:  Contains signature created by sender's private key AND copy of sender's PubKey
Output:  Contains the hash of the public key (PubKeyHash).