fix: CI fails — missing python3 + libclang-dev in sovereign-ci container

[noahgift]

Bug

All CI jobs fail:

• error: no Python 3.x interpreter found (pyo3-build-config)
• could not execute llvm-config (coverage job, needs libclang)

Five-Whys

1. Why no Python? sovereign-ci:stable container doesn't include Python 3.
2. Why does decy need Python? It uses PyO3 bindings.
3. Why doesn't the container have Python? It was designed for pure Rust projects.
4. Why wasn't this caught on onboarding? decy's PyO3 dep is an outlier.
5. Why can't it be added easily? Container changes affect all 20+ repos.

Fix

Add EXTRA_PKGS: python3 python3-dev libclang-dev to decy's ci.yml workflow, or add to sovereign-ci container.

🤖 Generated with Claude Code