feat(nexus): runtime provisioning for the decided stack (nexus-hub K-101)

- new install/nexus-runtime.sh (idempotent, re-runnable on an existing
  LXC): uv for the nexus user (manages Python 3.12), tesseract deu+eng,
  nexus-worker.service unit (ConditionPathExists guards the skeleton
  phase), sudoers extended to cover the worker service
- nexus-install.sh: RUNTIME section now invokes nexus-runtime.sh at the
  end of the install (after base sudoers/units, which it extends)

install/nexus-install.sh

@@ -57,11 +57,12 @@ else
   msg_warn "Node $(node -v) already present, skipping"
 fi
 
-# ── RUNTIME (extended by the stack-introducing SDD card in nexus-hub) ─────────
-# The nexus tech stack is not yet decided (nexus-hub Project Brief, open point 2).
-# When the stack card lands, it adds the runtime here (e.g. Python/uv, DB client
-# libs) AND documents the change in nexus-hub docs/agent-rules.md → Projekt-Kommandos.
-msg_warn "RUNTIME section is a placeholder until the nexus stack decision (see nexus-hub)"
+# ── RUNTIME ───────────────────────────────────────────────────────────────────
+# Stack decided (nexus-hub ADR-0002, card K-101): Python 3.12 via uv, tesseract
+# deu+eng, nexus-worker.service + sudoers extension. Provisioned by
+# install/nexus-runtime.sh, invoked at the END of this script (it extends the
+# sudoers rule and systemd units written below, so order matters). Commands are
+# documented in nexus-hub docs/05_AGENT_RULES.md → Projekt-Kommandos.
 
 # ── act_runner binary ─────────────────────────────────────────────────────────
 if [[ ! -x /usr/local/bin/act_runner ]]; then
@@ -165,6 +166,12 @@ systemctl enable nexus.service >/dev/null 2>&1
 systemctl enable --now nexus-runner.service
 msg_ok "systemd units installed (runner started; nexus.service enabled, starts on first deploy)"
 
+# ── RUNTIME provisioning (K-101): uv/Python 3.12, tesseract, worker unit ──────
+# Runs LAST on purpose: it extends the sudoers rule and unit set from above.
+# Idempotent — the same script retrofits an existing LXC:
+#   curl -fsSL .../install/nexus-runtime.sh | bash
+bash <(curl -fsSL "${LIB_URL%/lib}/install/nexus-runtime.sh")
+
 # ── notes / summary file ──────────────────────────────────────────────────────
 CRED_FILE="/root/nexus.credentials"
 cat >"$CRED_FILE" <<EOF