add python3 to core utils — node-gyp needs it, and node-gyp is not optional

node-pty ships prebuilt binaries for darwin-arm64, darwin-x64, win32-arm64 and
win32-x64. That is the complete list — there are no Linux prebuilds. So on Linux
its install script always falls through to `node-gyp rebuild` and compiles from
source, every time, on every machine.

node-gyp needs Python 3. python3 was in the old setup.sh and I dropped it when
rewriting the package list as "what the script itself would break without" —
which missed that the thing it breaks is not this script but `bun install`, later,
with an error about a Python that was never mentioned. The terminal sidecar then
does not come up, and the reason is three steps removed from the symptom.

build-essential was already there and is the other half of the same requirement;
they are now noted together where they are declared.

Found while answering whether node-pty constrains the Node version. It does not —
with no prebuilt binary there is no ABI to mismatch, so it builds against whatever
Node is installed, including 24. The exact-22 pin in package.json:11 is the
platform's own choice, not node-pty's requirement.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/packages.sh

@@ -51,7 +51,14 @@ LAST_SKIPPED=()
 # are the environment: nothing calls them, they are here because a box you use
 # should have them.
 #
-# Three entries reach beyond simply existing on the machine.
+# Four entries earn a note.
+#
+# python3 is not a tool anybody here calls — it is node-gyp's build dependency,
+# and node-gyp is not optional on Linux. node-pty ships prebuilt binaries for
+# darwin and win32 ONLY, so on Linux its install script always falls through to
+# `node-gyp rebuild` and compiles from source. Without python3 that fails, and
+# the failure surfaces as a broken terminal sidecar rather than as a missing
+# package. build-essential below is the other half of the same requirement.
 #
 # unattended-upgrades installs updates on a timer with nobody watching. apt only:
 # it is a Debian and Ubuntu package, dnf's equivalent is dnf-automatic and pacman
@@ -82,17 +89,17 @@ pkgs_core() {
       # fastfetch PPA. They have no counterpart on the other systems.
       echo curl ca-certificates gnupg git jq unzip \
         apt-transport-https lsb-release software-properties-common \
-        wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools \
+        wget zip build-essential python3 btop htop tree tmux ripgrep fd-find net-tools \
         fail2ban unattended-upgrades
       ;;
     pacman)
       echo curl ca-certificates gnupg git jq unzip \
-        wget zip base-devel btop htop tree tmux ripgrep fd net-tools \
+        wget zip base-devel python btop htop tree tmux ripgrep fd net-tools \
         fail2ban
       ;;
     dnf)
       echo curl ca-certificates gnupg2 git jq unzip \
-        wget zip btop htop tree tmux ripgrep fd-find net-tools \
+        wget zip python3 btop htop tree tmux ripgrep fd-find net-tools \
         fail2ban
       ;;
     brew)