fix(remote-dev): switch python3.11 source from deadsnakes PPA to uv

The deadsnakes PPA may not be reachable on every VM (corporate apt
proxy, Ubuntu derivatives that add-apt-repository misdetects, etc.).
`uv python install 3.11` works on any distro: it fetches a portable
python-build-standalone CPython into ~/.local/share/uv/python/, which
is manylinux-wheel-compatible.

Symlink the resulting binary to ~/.local/bin/python3.11 (already on
PATH from zprofile). Move the step to after `home-manager switch`
since uv comes from the nix profile.

3 files changed, 51 insertions, 46 deletions

diff --git a/remote-dev/README.md b/remote-dev/README.md
index d38b082..00640b5 100644
--- a/remote-dev/README.md
+++ b/remote-dev/README.md
@@ -134,19 +134,19 @@ git log --show-signature -1
 - **Network for first nvim launch**: `vim.pack.add` fetches plugins
   from GitHub on first start. Mason will also fetch LSP servers using
   `nodejs`/`uv` from this profile.
-- **Mason pip installs need `python3.11`**: a handful of Mason
-  packages (basedpyright, autotools-language-server, codespell,
-  mdformat, nginx-language-server, systemdlint, yamllint) install
-  themselves into per-pkg venvs via pip. Ubuntu 20.04's
-  `/usr/bin/python3` is 3.8 (too old, and `basedpyright` pulls
-  `nodejs-wheel-binaries` whose only Linux wheels are manylinux —
-  rejected by Nix's python, forcing a source build that needs gcc 12+).
-  `bootstrap.sh` installs `python3.11` from the deadsnakes PPA — it's
-  Ubuntu-native, accepts manylinux wheels, and the versioned name
-  (`python3.11`) leaves `/usr/bin/python3` untouched. On an existing
-  VM run `sudo add-apt-repository ppa:deadsnakes/ppa && sudo apt-get
-update && sudo apt-get install python3.11 python3.11-venv` once,
-  then `:MasonToolsInstall` (or `:MasonInstallAll`) in nvim.
+- **Mason pip installs need a managed `python3.11`**: a handful of Mason
+  packages (basedpyright, autotools-language-server, codespell, mdformat,
+  nginx-language-server, systemdlint, yamllint) install themselves into
+  per-pkg venvs via pip. Ubuntu 20.04's `/usr/bin/python3` is 3.8 (too
+  old; also `basedpyright` pulls `nodejs-wheel-binaries` whose only
+  Linux wheels are manylinux — rejected by Nix's python, which forces a
+  source build that needs gcc 12+). `bootstrap.sh` runs `uv python
+install 3.11` (uv is in the nix profile) and symlinks the resulting
+  binary to `~/.local/bin/python3.11`. It's a portable manylinux-aware
+  CPython, and the versioned name leaves `/usr/bin/python3` untouched.
+  On an existing VM run `uv python install 3.11 && ln -sf "$(uv python
+find 3.11)" ~/.local/bin/python3.11` once, then `:MasonToolsInstall`
+  (or `:MasonInstallAll`) in nvim.
 - **Ubuntu apt collisions**: Nix-installed binaries appear first in
   PATH. The leaf-tools policy above exists precisely to keep this
   shadowing contained to harmless tools.
diff --git a/remote-dev/bootstrap.sh b/remote-dev/bootstrap.sh
index 5ca4fe3..1b7dafe 100755
--- a/remote-dev/bootstrap.sh
+++ b/remote-dev/bootstrap.sh
@@ -8,7 +8,8 @@
 #   1. Install Nix (Determinate Systems installer, multi-user).
 #   2. Clone (or fast-forward) the dotfiles repo to ~/.local/share/dotfiles.
 #   3. Run `home-manager switch --flake .../remote-dev#vm`.
-#   4. Add Nix-store zsh to /etc/shells and chsh the user.
+#   4. Install python3.11 via `uv` (needed by Mason pip installs).
+#   5. Add Nix-store zsh to /etc/shells and chsh the user.
 #
 # Environment overrides:
 #   DOTFILES_REPO   Git URL (default: https://github.com/ruifm/dotfiles)
@@ -34,29 +35,8 @@ else
   log "Nix already installed, skipping installer."
 fi
 
-# ── 1b. Mason prerequisites from apt ──────────────────────────────────────────
-# Mason (in neovim) installs some LSPs/linters via pip into per-package venvs.
-# We need a python3.11 that (a) meets Mason's >=3.10 version requirement
-# (Ubuntu 20.04's /usr/bin/python3 is 3.8 — too old) and (b) accepts
-# manylinux wheels. Nix's python rejects manylinux wheels by design (its
-# libc is patched), which forces pip to compile `nodejs-wheel-binaries`
-# (pulled in by basedpyright) from source — that build then fails on
-# Ubuntu 20.04's gcc 9.4 (no C++20 support).
-#
-# Solution: install python3.11 from the deadsnakes PPA. It's Ubuntu-native
-# with full manylinux acceptance, and the versioned binary (python3.11)
-# does NOT shadow the system /usr/bin/python3 — leaf-tools policy intact.
-if command -v sudo >/dev/null 2>&1 && command -v apt-get >/dev/null 2>&1; then
-  if ! command -v python3.11 >/dev/null 2>&1; then
-    log "Installing python3.11 from deadsnakes PPA (required for Mason pip installs)…"
-    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
-      software-properties-common
-    sudo add-apt-repository -y ppa:deadsnakes/ppa
-    sudo apt-get update -qq
-    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
-      python3.11 python3.11-venv
-  fi
-fi
+# ── 1b. (moved to step 4 — uv comes from the nix profile, only available
+#         after `home-manager switch`) ─────────────────────────────────────────
 
 # Source nix env for the rest of this script (installer writes
 # /etc/profile.d/nix.sh but the current shell hasn't sourced it).
@@ -88,7 +68,32 @@ nix --extra-experimental-features 'nix-command flakes' \
   run home-manager/master -- \
   switch --impure --flake "$DIR/remote-dev#vm" -b backup
 
-# ── 4. chsh to nix-store zsh ─────────────────────────────────────────────────
+# ── 4. Mason's python interpreter (via uv from the nix profile) ──────────────
+# Mason installs some LSPs/linters into per-package pip venvs. We need a
+# python3.11 that:
+#   (a) meets Mason's >=3.10 version requirement (Ubuntu 20.04 ships
+#       /usr/bin/python3 = 3.8 — too old), and
+#   (b) accepts manylinux wheels (Nix's python rejects them by design;
+#       pip then falls back to compiling `nodejs-wheel-binaries` from
+#       source, which fails on the host's gcc 9.4 — needs C++20).
+#
+# `uv python install 3.11` fetches a portable CPython build (python-build-
+# standalone, manylinux-compatible) into ~/.local/share/uv/python/. We
+# symlink its `python3.11` into ~/.local/bin/ (already on PATH from
+# zprofile) so Mason discovers it. Does NOT shadow /usr/bin/python3 —
+# leaf-tools policy intact. Works on any distro/release, no PPA required.
+UV_BIN="$HOME/.nix-profile/bin/uv"
+if [ -x "$UV_BIN" ]; then
+  if [ ! -x "$HOME/.local/bin/python3.11" ]; then
+    log "Installing python3.11 via uv (required for Mason pip installs)…"
+    "$UV_BIN" python install 3.11
+    UV_PY311="$("$UV_BIN" python find 3.11)"
+    mkdir -p "$HOME/.local/bin"
+    ln -sf "$UV_PY311" "$HOME/.local/bin/python3.11"
+  fi
+fi
+
+# ── 5. chsh to nix-store zsh ─────────────────────────────────────────────────
 NIX_ZSH="$HOME/.nix-profile/bin/zsh"
 if [ -x "$NIX_ZSH" ]; then
   if ! grep -qxF "$NIX_ZSH" /etc/shells 2>/dev/null; then
diff --git a/remote-dev/home.nix b/remote-dev/home.nix
index 576e6d8..1a1b98f 100644
--- a/remote-dev/home.nix
+++ b/remote-dev/home.nix
@@ -86,14 +86,14 @@ in
     uv        # Mason python LSPs in isolated venvs; brings `uv`/`uvx` only
     jre       # for Mason's groovy-language-server (headless Java runtime)
 
-    # NB: python3.11 for Mason is NOT installed here — see bootstrap.sh.
-    # Nix's python disables manylinux wheel support by design (its libc is
-    # patched and doesn't satisfy any manylinux policy), so pip in a
-    # nix-python venv falls back to source builds for packages like
-    # `nodejs-wheel-binaries` (pulled in by basedpyright). That source build
-    # then fails on Ubuntu 20.04's gcc 9.4 (no C++20). Bootstrap installs
-    # `python3.11` via the deadsnakes PPA instead — Ubuntu-native binary
-    # with full manylinux wheel acceptance.
+    # NB: python3.11 for Mason is NOT installed here — see bootstrap.sh
+    # step 4. Nix's python disables manylinux wheel support by design
+    # (its libc is patched and doesn't satisfy any manylinux policy), so
+    # pip in a nix-python venv falls back to source builds for packages
+    # like `nodejs-wheel-binaries` (pulled in by basedpyright). That
+    # source build then fails on Ubuntu 20.04's gcc 9.4 (no C++20).
+    # Bootstrap uses `uv python install 3.11` to fetch a portable
+    # manylinux-aware CPython and symlinks it to ~/.local/bin/python3.11.
 
     # Rust toolchain for Mason packages whose only install source is
     # `cargo install` (shellharden). The host has these via the Arch