The Debian runner image marks its Python as externally managed, so `pip3 install` fails with error: externally-managed-environment, breaking the test/lint/security workflows at the install step (unrelated to the code under test). Add --break-system-packages; the runner is ephemeral so a system-wide install is fine. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>