Fall back when runner lacks python venv/ensurepip.

Linux self-hosted runners without python3-venv fail job-local venv; use pip --break-system-packages so refresh can still install deps.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/web-patch.yml

@@ -37,9 +37,16 @@ jobs:
           PYTHON=python3
           command -v python3 >/dev/null || PYTHON=python
           command -v node >/dev/null || { echo "node/npx required for wrangler deploy"; exit 1; }
-          # Job-local venv: Homebrew/PEP 668 blocks system pip install.
-          "$PYTHON" -m venv .venv
-          .venv/bin/pip install -q -r web/requirements.txt
+          # Prefer job-local venv (PEP 668). Some runners lack ensurepip/python3-venv.
+          rm -rf .venv
+          if "$PYTHON" -m venv .venv; then
+            .venv/bin/pip install -q -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PWD}/.venv/bin/python" >> "$GITHUB_ENV"
+          else
+            echo "venv unavailable; pip --break-system-packages"
+            "$PYTHON" -m pip install -q --break-system-packages -r web/requirements.txt
+            echo "CLIMPEROR_PY=${PYTHON}" >> "$GITHUB_ENV"
+          fi
 
       - name: Refresh patch tier
         env:
@@ -51,7 +58,7 @@ jobs:
           OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
         run: |
           set -e
-          .venv/bin/python web/refresh_web.py --tier patch
+          "${CLIMPEROR_PY}" web/refresh_web.py --tier patch
 
       - name: Save refresh summary
         if: always()