- new install/nexus-runtime.sh (idempotent, re-runnable on an existing LXC): uv for the nexus user (manages Python 3.12), tesseract deu+eng, nexus-worker.service unit (ConditionPathExists guards the skeleton phase), sudoers extended to cover the worker service - nexus-install.sh: RUNTIME section now invokes nexus-runtime.sh at the end of the install (after base sudoers/units, which it extends)