fix(nvim,remote-dev): fall back to PATH node + provide JRE/shellharden/python3-venv

copilot.lua was hard-coding the chezmoi-pinned Node 24 at
~/.local/share/copilot-node/bin/node, which only exists on the Arch
host where chezmoi runs run_onchange_after_install-copilot-node.sh.
On the remote-dev VM the path is absent, so copilot-language-server
spawned with cmd[0]=<missing> and printed 'Could not determine
Node.js version'. Probe the pinned path with vim.fn.executable() and
fall back to 'node' from PATH otherwise.

For the VM PATH 'node' to be a supported version, switch home.nix
from the rolling 'nodejs' alias to 'nodejs_24' (the version the
chezmoi script also pins on the host).

Address the cluster of Mason install failures on the VM:
  - autotools-language-server, codespell, mdformat,
    nginx-language-server, systemdlint -- pip-installed; fail because
    Ubuntu's python3 ships without venv. bootstrap.sh now apt-installs
    python3-venv; README documents the manual command for existing VMs.
  - groovy-language-server -- needs a JRE. Add 'jre' to home.packages.
  - shellharden -- Mason's cargo fallback can't run under our
    leaf-tools policy. Provide the binary via nix-profile instead so
    Mason finds it on PATH.

1 files changed, 15 insertions, 0 deletions

diff --git a/remote-dev/bootstrap.sh b/remote-dev/bootstrap.sh
index 48cea11..157c902 100755
--- a/remote-dev/bootstrap.sh
+++ b/remote-dev/bootstrap.sh
@@ -34,6 +34,21 @@ else
   log "Nix already installed, skipping installer."
 fi
 
+# ── 1b. Mason prerequisites from apt ──────────────────────────────────────────
+# Mason (in neovim) installs some LSPs/linters via pip into per-package venvs.
+# Ubuntu ships python3 without the venv module by default, so without
+# python3-venv every pip-based Mason package silently fails to install.
+# Affected: autotools-language-server, codespell, mdformat, nginx-language-server,
+# systemdlint. We deliberately don't pull python3 into the Nix profile (it
+# would shadow Ubuntu's and break system builds — see remote-dev/home.nix).
+if command -v sudo >/dev/null 2>&1 && command -v apt-get >/dev/null 2>&1; then
+  if ! dpkg -s python3-venv >/dev/null 2>&1; then
+    log "Installing python3-venv via apt (required for Mason pip installs)…"
+    sudo apt-get update -qq
+    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-venv
+  fi
+fi
+
 # Source nix env for the rest of this script (installer writes
 # /etc/profile.d/nix.sh but the current shell hasn't sourced it).
 if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then