Detect ensurepip and auto-install python3-venv in one-click deploy.

Avoid false OK on bare python3; repair broken .venv; re-check deps after git pull.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/lib/common.sh

@@ -187,8 +187,9 @@ resolve_repo_root() {
 
 python_runtime_ok() {
   command -v python3 >/dev/null 2>&1 || return 1
-  # 能创建 venv 即可；pip 在项目 .venv 内安装
-  python3 -c "import venv" >/dev/null 2>&1 || return 1
+  # Ubuntu 常有 python3 且 import venv 成功，但缺 python3.X-venv 时 ensurepip 不可用，
+  # python3 -m venv 会失败。必须以 ensurepip 为准。
+  python3 -c "import ensurepip" >/dev/null 2>&1 || return 1
   return 0
 }
 
@@ -222,15 +223,22 @@ print_runtime_probe() {
 }
 
 install_python_runtime() {
-  step "安装 Python3 环境 (python3 / venv / pip)"
+  step "安装 Python3 环境 (python3 / venv / pip / ensurepip)"
   export DEBIAN_FRONTEND=noninteractive
   if ! command -v apt-get >/dev/null 2>&1; then
     die "非 apt 系统，请手动安装 python3 python3-venv python3-pip"
   fi
   apt_update
   apt_install python3 python3-venv python3-pip
+  # Debian/Ubuntu：版本化包（如 python3.10-venv）才真正提供 ensurepip
+  local pyver=""
+  pyver="$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")' 2>/dev/null || true)"
+  if [[ -n "${pyver}" ]]; then
+    log "安装 python${pyver}-venv（提供 ensurepip）…"
+    apt_install "python${pyver}-venv" || true
+  fi
   if ! python_runtime_ok; then
-    die "Python 环境安装后仍不可用，请检查 apt 源"
+    die "Python 环境安装后仍不可用（缺 ensurepip）。请检查: apt install python3-venv python${pyver:-3}-venv"
   fi
   log "Python 已就绪: $(python3 --version 2>&1)"
 }