work-records gate: runner substrate fix (apt python3 on ubuntu-latest)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/work-records.yaml

@@ -18,11 +18,15 @@ on:
 
 jobs:
   validate:
-    runs-on: self-hosted
+    # Runner substrate: ubuntu-latest maps to docker://node:20-bookworm (no
+    # python) — install python3 + deps via apt (same pattern as kaizen ci.yml).
+    runs-on: ubuntu-latest
     steps:
       - name: Fetch repo + canon, validate work records
         run: |
           set -eu
+          apt-get update -qq >/dev/null
+          apt-get install -y -qq python3 python3-yaml python3-jsonschema wget >/dev/null
           WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
           REF="${GITHUB_SHA:-main}"; SHORT="${REF:0:7}"
           BASE="https://forgejo.coulomb.social"
@@ -34,6 +38,5 @@ jobs:
           wget -qO "$WORK/canon.tar.gz" \
             "${BASE}/coulomb/the-custodian/archive/main.tar.gz"
           tar xzf "$WORK/canon.tar.gz" -C "$WORK/canon" --strip-components=1
-          python3 -m pip install --user --quiet pyyaml jsonschema
           python3 "$WORK/canon/tools/validate_work_records.py" \
             --repo "$WORK/repo" --canon "$WORK/canon"