feat(base): install python313 on every NixOS host

Hosts without Home Manager (aquamarine, the VM hosts, k3s guests) had no
interpreter. The system profile is separate from the per-user one, so desktops
keep their Home Manager copy in PATH.

Assisted-by: DeepSeek Harness 0.2.1-rc.2 (deepseek-flash)

modules/nixos/base/packages.nix

@@ -37,6 +37,9 @@ in
         psmisc # killall/pstree/prtstat/fuser/...
         ethtool
         pv # pipe view
+
+        # System-wide interpreter; Home Manager's python313 on desktops is a separate profile.
+        python313
       ]
       ++ lib.optionals hardwareTools.enable [
         lm_sensors # `sensors` command

outputs/x86_64-linux/tests/idols-aquamarine/expected.nix

@@ -20,6 +20,7 @@
   collectorFlagsUnique = true;
   inferenceUserCanRender = true;
   noHomeManager = true;
+  pythonInstalled = true;
   staticAddressMatchesWiredInterface = true;
   rootIsTmpfs = true;
   stateIsPersistent = true;

outputs/x86_64-linux/tests/idols-aquamarine/expr.nix

@@ -82,6 +82,9 @@ in
 
   # Headless: no desktop session, no Home Manager.
   noHomeManager = !cfg ? home-manager.users;
+  pythonInstalled = builtins.any (
+    package: lib.hasPrefix "python3-" (package.name or "")
+  ) cfg.environment.systemPackages;
 
   # The board renames the wired NIC with the PCIe topology, so networkd matches the
   # `en*` prefix; a name-based match leaves the host without an address.