fix(nvim,remote-dev): fall back to PATH node + provide JRE/shellharden/python3-venv

copilot.lua was hard-coding the chezmoi-pinned Node 24 at
~/.local/share/copilot-node/bin/node, which only exists on the Arch
host where chezmoi runs run_onchange_after_install-copilot-node.sh.
On the remote-dev VM the path is absent, so copilot-language-server
spawned with cmd[0]=<missing> and printed 'Could not determine
Node.js version'. Probe the pinned path with vim.fn.executable() and
fall back to 'node' from PATH otherwise.

For the VM PATH 'node' to be a supported version, switch home.nix
from the rolling 'nodejs' alias to 'nodejs_24' (the version the
chezmoi script also pins on the host).

Address the cluster of Mason install failures on the VM:
  - autotools-language-server, codespell, mdformat,
    nginx-language-server, systemdlint -- pip-installed; fail because
    Ubuntu's python3 ships without venv. bootstrap.sh now apt-installs
    python3-venv; README documents the manual command for existing VMs.
  - groovy-language-server -- needs a JRE. Add 'jre' to home.packages.
  - shellharden -- Mason's cargo fallback can't run under our
    leaf-tools policy. Provide the binary via nix-profile instead so
    Mason finds it on PATH.

1 files changed, 7 insertions, 0 deletions

diff --git a/remote-dev/README.md b/remote-dev/README.md
index 4622f31..bdb81ca 100644
--- a/remote-dev/README.md
+++ b/remote-dev/README.md
@@ -134,6 +134,13 @@ git log --show-signature -1
 - **Network for first nvim launch**: `vim.pack.add` fetches plugins
   from GitHub on first start. Mason will also fetch LSP servers using
   `nodejs`/`uv` from this profile.
+- **Mason pip installs need `python3-venv`**: a handful of Mason
+  packages (autotools-language-server, codespell, mdformat,
+  nginx-language-server, systemdlint) install themselves into per-pkg
+  venvs via `python3 -m venv`. Ubuntu ships `python3` without the
+  `venv` module by default. `bootstrap.sh` installs `python3-venv`
+  via apt; on an existing VM run `sudo apt-get install python3-venv`
+  once, then `:MasonToolsInstall` (or `:MasonInstallAll`) in nvim.
 - **Ubuntu apt collisions**: Nix-installed binaries appear first in
   PATH. The leaf-tools policy above exists precisely to keep this
   shadowing contained to harmless tools.