fix(nvim,remote-dev): fall back to PATH node + provide JRE/shellharden/python3-venv

copilot.lua was hard-coding the chezmoi-pinned Node 24 at
~/.local/share/copilot-node/bin/node, which only exists on the Arch
host where chezmoi runs run_onchange_after_install-copilot-node.sh.
On the remote-dev VM the path is absent, so copilot-language-server
spawned with cmd[0]=<missing> and printed 'Could not determine
Node.js version'. Probe the pinned path with vim.fn.executable() and
fall back to 'node' from PATH otherwise.

For the VM PATH 'node' to be a supported version, switch home.nix
from the rolling 'nodejs' alias to 'nodejs_24' (the version the
chezmoi script also pins on the host).

Address the cluster of Mason install failures on the VM:
  - autotools-language-server, codespell, mdformat,
    nginx-language-server, systemdlint -- pip-installed; fail because
    Ubuntu's python3 ships without venv. bootstrap.sh now apt-installs
    python3-venv; README documents the manual command for existing VMs.
  - groovy-language-server -- needs a JRE. Add 'jre' to home.packages.
  - shellharden -- Mason's cargo fallback can't run under our
    leaf-tools policy. Provide the binary via nix-profile instead so
    Mason finds it on PATH.

4 files changed, 43 insertions, 8 deletions

diff --git a/dot_config/nvim/lua/plugins/ai.lua b/dot_config/nvim/lua/plugins/ai.lua
index 6578037..6ebc6f5 100644
--- a/dot_config/nvim/lua/plugins/ai.lua
+++ b/dot_config/nvim/lua/plugins/ai.lua
@@ -1,12 +1,19 @@
+-- Prefer the chezmoi-pinned Node 24 (host has Arch's system node 26, which
+-- breaks copilot-language-server — see
+-- ~/.local/share/chezmoi/run_onchange_after_install-copilot-node.sh). Fall
+-- back to `node` on PATH for hosts that don't run chezmoi (remote-dev VM
+-- via Nix Home-Manager, where home.nix pins nodejs_24 in the profile).
+local pinned_node = vim.fs.joinpath(
+  vim.env.XDG_DATA_HOME or (vim.env.HOME .. "/.local/share"),
+  "copilot-node/bin/node"
+)
+local copilot_node = vim.fn.executable(pinned_node) == 1 and pinned_node
+  or "node"
+
 require("copilot").setup({
   suggestion = { enabled = false },
   panel = { enabled = false },
-  -- Pinned Node 24 runtime; system nodejs (26.x) is incompatible with
-  -- copilot-language-server. See ~/.local/share/chezmoi/run_onchange_after_install-copilot-node.sh
-  copilot_node_command = vim.fs.joinpath(
-    vim.env.XDG_DATA_HOME or (vim.env.HOME .. "/.local/share"),
-    "copilot-node/bin/node"
-  ),
+  copilot_node_command = copilot_node,
   server_opts_overrides = {
     settings = {
       telemetry = {
diff --git a/remote-dev/README.md b/remote-dev/README.md
index 4622f31..bdb81ca 100644
--- a/remote-dev/README.md
+++ b/remote-dev/README.md
@@ -134,6 +134,13 @@ git log --show-signature -1
 - **Network for first nvim launch**: `vim.pack.add` fetches plugins
   from GitHub on first start. Mason will also fetch LSP servers using
   `nodejs`/`uv` from this profile.
+- **Mason pip installs need `python3-venv`**: a handful of Mason
+  packages (autotools-language-server, codespell, mdformat,
+  nginx-language-server, systemdlint) install themselves into per-pkg
+  venvs via `python3 -m venv`. Ubuntu ships `python3` without the
+  `venv` module by default. `bootstrap.sh` installs `python3-venv`
+  via apt; on an existing VM run `sudo apt-get install python3-venv`
+  once, then `:MasonToolsInstall` (or `:MasonInstallAll`) in nvim.
 - **Ubuntu apt collisions**: Nix-installed binaries appear first in
   PATH. The leaf-tools policy above exists precisely to keep this
   shadowing contained to harmless tools.
diff --git a/remote-dev/bootstrap.sh b/remote-dev/bootstrap.sh
index 48cea11..157c902 100755
--- a/remote-dev/bootstrap.sh
+++ b/remote-dev/bootstrap.sh
@@ -34,6 +34,21 @@ else
   log "Nix already installed, skipping installer."
 fi
 
+# ── 1b. Mason prerequisites from apt ──────────────────────────────────────────
+# Mason (in neovim) installs some LSPs/linters via pip into per-package venvs.
+# Ubuntu ships python3 without the venv module by default, so without
+# python3-venv every pip-based Mason package silently fails to install.
+# Affected: autotools-language-server, codespell, mdformat, nginx-language-server,
+# systemdlint. We deliberately don't pull python3 into the Nix profile (it
+# would shadow Ubuntu's and break system builds — see remote-dev/home.nix).
+if command -v sudo >/dev/null 2>&1 && command -v apt-get >/dev/null 2>&1; then
+  if ! dpkg -s python3-venv >/dev/null 2>&1; then
+    log "Installing python3-venv via apt (required for Mason pip installs)…"
+    sudo apt-get update -qq
+    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-venv
+  fi
+fi
+
 # Source nix env for the rest of this script (installer writes
 # /etc/profile.d/nix.sh but the current shell hasn't sourced it).
 if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
diff --git a/remote-dev/home.nix b/remote-dev/home.nix
index 98376a4..d178eca 100644
--- a/remote-dev/home.nix
+++ b/remote-dev/home.nix
@@ -82,8 +82,14 @@ in
     clang-tools
 
     # Editor/AI agent runtimes — NOT for project builds (see policy above)
-    nodejs # Mason npm LSPs; system python3 stays at /usr/bin/python3
-    uv     # Mason python LSPs in isolated venvs; brings `uv`/`uvx` only
+    nodejs_24 # Mason npm LSPs + copilot-language-server (needs Node 24, see ai.lua)
+    uv        # Mason python LSPs in isolated venvs; brings `uv`/`uvx` only
+    jre # for Mason's groovy-language-server (headless Java runtime)
+
+    # Mason fallbacks: Mason's pip/cargo installers can't run on this VM
+    # under our leaf-tools policy, so we provide these binaries on PATH and
+    # let nvim/Mason find them there instead of trying to build them.
+    shellharden
 
     # AI coding agents
     claude-code