fix(integration): pin system python for virt-install (venv PATH hijack)

The Makefile prepends .venv/bin to PATH (so the venv's ansible tools resolve),
but virt-install's `#!/usr/bin/env python3` shebang then resolved to the
isolated venv, which lacks system PyGObject (gi) -> ModuleNotFoundError. Strip
.venv/bin from PATH for the virt-install call so its shebang finds
/usr/bin/python3 (which has gi); ansible runs via its absolute .venv path and is
unaffected. Surfaced running `make test-integration HOST=ubongo`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/integration-vm.py

@@ -201,6 +201,13 @@ def up(host, name=None, mem_mib=DEFAULT_MEM_MIB, vcpus=DEFAULT_VCPUS):
     sh(["cloud-localds", "--network-config", str(RUN_DIR / "network-config"),
         str(seed), str(RUN_DIR / "user-data"), str(RUN_DIR / "meta-data")])
     console = CACHE_DIR / f"{name}-console.log"
+    # virt-install has a `#!/usr/bin/env python3` shebang; the Makefile prepends .venv/bin to
+    # PATH (so the venv's ansible tools resolve), which would hijack virt-install into the
+    # isolated venv — it lacks system PyGObject (`gi`) and crashes. Strip the venv from PATH
+    # for this system tool so its shebang finds /usr/bin/python3 (which has gi). Ansible is
+    # invoked via its absolute .venv path elsewhere, so it is unaffected.
+    sys_path = ":".join(p for p in os.environ.get("PATH", "").split(":")
+                        if "/.venv/bin" not in p)
     sh(["virt-install", "--name", name, "--memory", str(mem_mib), "--vcpus", str(vcpus),
         "--boot", "uefi",   # genericcloud triple-faults on legacy BIOS handoff; UEFI boots
         "--import",
@@ -210,7 +217,8 @@ def up(host, name=None, mem_mib=DEFAULT_MEM_MIB, vcpus=DEFAULT_VCPUS):
         "--osinfo", "debian13",
         "--graphics", "none",
         "--serial", f"file,path={console}",
-        "--noautoconsole"])
+        "--noautoconsole"],
+       env=dict(os.environ, PATH=sys_path))
     ip = wait_for_ip(name)
     wait_for_ssh(ip, "ansible")
     # Block until cloud-init finishes (incl. apt-get update) so apply sees a ready system.