fix(remote-dev): use deadsnakes python3.11 instead of nix for Mason

Nix's python rejects manylinux wheels by design (its libc is patched),
which forced pip in Mason's per-pkg venvs to compile nodejs-wheel-binaries
(pulled in by basedpyright) from source. That source build then failed on
Ubuntu 20.04's gcc 9.4 — Node 24 requires C++20 (g++ >= 12.2.0).

Replace the nix python311-versioned-only derivation with an Ubuntu-native
python3.11 from the deadsnakes PPA. It satisfies Mason's >=3.10 version
requirement, accepts manylinux wheels, and the versioned binary name
leaves /usr/bin/python3 untouched (leaf-tools policy preserved).

3 files changed, 38 insertions, 25 deletions

diff --git a/remote-dev/README.md b/remote-dev/README.md
index bdb81ca..d38b082 100644
--- a/remote-dev/README.md
+++ b/remote-dev/README.md
@@ -134,13 +134,19 @@ git log --show-signature -1
 - **Network for first nvim launch**: `vim.pack.add` fetches plugins
   from GitHub on first start. Mason will also fetch LSP servers using
   `nodejs`/`uv` from this profile.
-- **Mason pip installs need `python3-venv`**: a handful of Mason
-  packages (autotools-language-server, codespell, mdformat,
-  nginx-language-server, systemdlint) install themselves into per-pkg
-  venvs via `python3 -m venv`. Ubuntu ships `python3` without the
-  `venv` module by default. `bootstrap.sh` installs `python3-venv`
-  via apt; on an existing VM run `sudo apt-get install python3-venv`
-  once, then `:MasonToolsInstall` (or `:MasonInstallAll`) in nvim.
+- **Mason pip installs need `python3.11`**: a handful of Mason
+  packages (basedpyright, autotools-language-server, codespell,
+  mdformat, nginx-language-server, systemdlint, yamllint) install
+  themselves into per-pkg venvs via pip. Ubuntu 20.04's
+  `/usr/bin/python3` is 3.8 (too old, and `basedpyright` pulls
+  `nodejs-wheel-binaries` whose only Linux wheels are manylinux —
+  rejected by Nix's python, forcing a source build that needs gcc 12+).
+  `bootstrap.sh` installs `python3.11` from the deadsnakes PPA — it's
+  Ubuntu-native, accepts manylinux wheels, and the versioned name
+  (`python3.11`) leaves `/usr/bin/python3` untouched. On an existing
+  VM run `sudo add-apt-repository ppa:deadsnakes/ppa && sudo apt-get
+update && sudo apt-get install python3.11 python3.11-venv` once,
+  then `:MasonToolsInstall` (or `:MasonInstallAll`) in nvim.
 - **Ubuntu apt collisions**: Nix-installed binaries appear first in
   PATH. The leaf-tools policy above exists precisely to keep this
   shadowing contained to harmless tools.
diff --git a/remote-dev/bootstrap.sh b/remote-dev/bootstrap.sh
index 157c902..5ca4fe3 100755
--- a/remote-dev/bootstrap.sh
+++ b/remote-dev/bootstrap.sh
@@ -36,16 +36,25 @@ fi
 
 # ── 1b. Mason prerequisites from apt ──────────────────────────────────────────
 # Mason (in neovim) installs some LSPs/linters via pip into per-package venvs.
-# Ubuntu ships python3 without the venv module by default, so without
-# python3-venv every pip-based Mason package silently fails to install.
-# Affected: autotools-language-server, codespell, mdformat, nginx-language-server,
-# systemdlint. We deliberately don't pull python3 into the Nix profile (it
-# would shadow Ubuntu's and break system builds — see remote-dev/home.nix).
+# We need a python3.11 that (a) meets Mason's >=3.10 version requirement
+# (Ubuntu 20.04's /usr/bin/python3 is 3.8 — too old) and (b) accepts
+# manylinux wheels. Nix's python rejects manylinux wheels by design (its
+# libc is patched), which forces pip to compile `nodejs-wheel-binaries`
+# (pulled in by basedpyright) from source — that build then fails on
+# Ubuntu 20.04's gcc 9.4 (no C++20 support).
+#
+# Solution: install python3.11 from the deadsnakes PPA. It's Ubuntu-native
+# with full manylinux acceptance, and the versioned binary (python3.11)
+# does NOT shadow the system /usr/bin/python3 — leaf-tools policy intact.
 if command -v sudo >/dev/null 2>&1 && command -v apt-get >/dev/null 2>&1; then
-  if ! dpkg -s python3-venv >/dev/null 2>&1; then
-    log "Installing python3-venv via apt (required for Mason pip installs)…"
+  if ! command -v python3.11 >/dev/null 2>&1; then
+    log "Installing python3.11 from deadsnakes PPA (required for Mason pip installs)…"
+    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
+      software-properties-common
+    sudo add-apt-repository -y ppa:deadsnakes/ppa
     sudo apt-get update -qq
-    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-venv
+    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
+      python3.11 python3.11-venv
   fi
 fi
 
diff --git a/remote-dev/home.nix b/remote-dev/home.nix
index 4aeff8a..576e6d8 100644
--- a/remote-dev/home.nix
+++ b/remote-dev/home.nix
@@ -86,16 +86,14 @@ in
     uv        # Mason python LSPs in isolated venvs; brings `uv`/`uvx` only
     jre       # for Mason's groovy-language-server (headless Java runtime)
 
-    # Mason's pip-installer probes `python3.13`, `python3.12`, ..., `python3.10`
-    # in PATH (in addition to `python3`) when picking an interpreter for the
-    # per-pkg venvs it creates. Ubuntu 20.04 ships only `python3` = 3.8 which
-    # is too old for codespell/mdformat/yamllint/etc. We expose ONLY the
-    # versioned `python3.11` binary so we don't shadow the system `python3`
-    # (preserving the leaf-tools policy: system builds keep using /usr/bin/python3).
-    (pkgs.runCommand "python311-versioned-only" { } ''
-      mkdir -p $out/bin
-      ln -s ${pkgs.python311}/bin/python3.11 $out/bin/python3.11
-    '')
+    # NB: python3.11 for Mason is NOT installed here — see bootstrap.sh.
+    # Nix's python disables manylinux wheel support by design (its libc is
+    # patched and doesn't satisfy any manylinux policy), so pip in a
+    # nix-python venv falls back to source builds for packages like
+    # `nodejs-wheel-binaries` (pulled in by basedpyright). That source build
+    # then fails on Ubuntu 20.04's gcc 9.4 (no C++20). Bootstrap installs
+    # `python3.11` via the deadsnakes PPA instead — Ubuntu-native binary
+    # with full manylinux wheel acceptance.
 
     # Rust toolchain for Mason packages whose only install source is
     # `cargo install` (shellharden). The host has these via the Arch