The Debian runner image marks its Python as externally managed, so
`pip3 install` fails with error: externally-managed-environment, breaking
the test/lint/security workflows at the install step (unrelated to the code
under test). Add --break-system-packages; the runner is ephemeral so a
system-wide install is fine.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>