Ubuntu worker package list omits python3-dev, so the runner cannot be rebuilt from provisioning

## Problem

`live_vm_host_packages` is the declared "venv build deps" list for the Ubuntu worker host, and it
omits **`python3-dev`** — the package that provides `Python.h`. Both C extensions the list exists
to build, `libvirt-python` and `drgn`, need it.

The self-hosted runner works only because `python3-dev` was pulled in there as an *automatic*
apt dependency. That dependency no longer materialises on a current Ubuntu 26.04, so **the runner
cannot be rebuilt from its own provisioning code today.**

## Observed

Provisioning a freshly-imaged Ubuntu 26.04.1 host with the `live_vm_host` role fails:

```
error: Failed to build `libvirt-python==12.5.0`
cause: Call to `setuptools.build_meta.build_wheel` failed (exit status: 1)
build/libvirt.c:3:10: fatal error: Python.h: No such file or directory
3 | #include
| ^~~~~~~~~~
hint: This error likely indicates that you need to install a library that provides "Python.h"
for `libvirt-python@12.5.0`
```

The failing task is the role's own `uv sync --python /usr/bin/python3 --group live`, so the
failure is inside provisioning, not in anything downstream of it.

## Evidence

`deploy/ansible/roles/local_worker_host/defaults/main.yml:9` declares the list, and its own
comment states the purpose:

> Kernel-debug toolchain + venv build deps the live_vm contract needs beyond libvirt_stack, on
> the Ubuntu 26.04 runner base (ADR-0387). **drgn and libvirt-python are built from PyPI into the
> venv, so their -dev headers (libvirt-dev, libelf/libdw/libkdumpfile) are build deps here**

The list carries `build-essential`, `pkg-config`, `libvirt-dev`, `libelf-dev`, `libdw-dev` and
`libkdumpfile-dev` — every `-dev` header except the Python one those compilers need first.

**Why the existing runner does not show this.** On the provisioned runner, apt's own records say
`python3-dev` was never requested:

```
$ apt-mark showauto python3-dev
python3-dev
$ apt-mark showmanual python3-dev
# (empty)
```

and its install line in `apt` history shows it arriving as a side effect of the role's explicit
set:

```
Commandline: apt-get -y ... install gdb=... python3-guestfs=... python3-pip=... build-essential=...
pkg-config=... libvirt-dev=... libelf-dev=... libdw-dev=... libkdumpfile-dev=...
Install: ... python3-dev:amd64 (3.14.3-0ubuntu2, automatic) ...
libpython3.14-dev:amd64 (..., automatic), python3.14-dev:amd64 (..., automatic) ...
```

`automatic` is the whole point: nothing in the repository asked for it. Running the same explicit
set against a current Ubuntu 26.04.1 image does not pull it in, and the build fails as above.
Installing `python3-dev` by hand on the new host makes the identical playbook run proceed.

## Why it matters

The runner is the only host that runs the native `live_vm` tier. Its provisioning is therefore the
reproducibility boundary for that whole gate, and today that boundary is resting on an apt
dependency edge no one declared and nothing tests. Any of these re-breaks it:

- rebuilding or re-imaging the runner;
- adding a second runner;
- an upstream change to what `python3-guestfs`, `python3-pip` or `libvirt-dev` depend on.

Nothing fails loudly until someone tries to build a host, which is exactly when the information
is least available.

## Expected

`python3-dev` is declared in `live_vm_host_packages` alongside the other `-dev` headers, so the
list states its own requirements instead of inheriting them.

Note the list is pinned by a test: `deploy/ansible/tests/run-local-worker-host.py:69` compares it
against `deploy/ansible/tests/fixtures/ubuntu-worker-packages-2391.txt` and asserts "Ubuntu worker
package list changed", with a following assertion naming a package count. The fixture and that
count both need updating in the same change, which is a feature here — it means the declared list
cannot drift silently.

## Out of scope

- The RedHat and SUSE package lists. They are separate variables on a path this host does not
take, and whether they have the same gap was not checked.
- `provider_authority_host`, which already declares `python3-dev` (Debian) and `python3-devel`
(RedHat) in `defaults/main.yml:50-51`. That it gets this right is why the omission here reads
as an oversight rather than a deliberate choice.

## Provenance

Found while provisioning a clean Ubuntu 26.04.1 host from a snapshot baseline in order to run a
live proof for an unrelated pull request. The host was deliberately bare, which is what exposed a
dependency the established host had already satisfied by accident. Confirmed against the
established runner with `apt-mark`/`apt` history rather than inferred from the failure alone.

Start with deploy/ansible/roles/local_worker_host/defaults/main.yml:9 and inspect the live_vm_host_packages declaration. Run deploy/ansible/tests/run-local-worker-host.py and update the referenced ubuntu-worker-packages-2391.txt fixture and package-count assertion alongside the declared list. Done means the package list includes the missing build dependency and the test passes.

Written by the indexing model from the issue text.