fix(docker): apt install python3-pip first — v1.4.3 round 2

[notabotchef]

Summary

v1.4.2's pip fix was incomplete. The next docker-publish run got past the bare pip issue but immediately hit:

#12 0.117 /usr/bin/python3: No module named pip

frdel/agent-zero-run ships python3 without the pip module bundled. So both pip (v1.4.1) and python3 -m pip (v1.4.2) fail for the same root cause: pip is simply not installed.

Fix

RUN apt-get update \
    && apt-get install -y --no-install-recommends python3-pip \
    && rm -rf /var/lib/apt/lists/* \
    && python3 -m pip install --no-cache-dir --break-system-packages \
        "websockets>=13.1,<17.0" \
        "cryptography>=42.0,<45.0" \
        pyyaml \
    && for venv_pip in /opt/venv/bin/pip /a0/venv/bin/pip /usr/local/venv/bin/pip; do \
        if [ -x "$venv_pip" ]; then \
            "$venv_pip" install --no-cache-dir \
                "websockets>=13.1,<17.0" \
                "cryptography>=42.0,<45.0" \
                pyyaml; \
        fi; \
    done

• apt-get install python3-pip first — guarantees pip exists. Adds ~5 MB and one layer.
• python3 -m pip install --break-system-packages for PEP 668 (Debian Bookworm+).
• Loop over candidate A0 venv paths (/opt/venv, /a0/venv, /usr/local/venv) and install the same packages into any that exist. Belt-and-suspenders for whichever Python A0 hands the plugin at runtime.

Test plan

• bash -n of the RUN block — clean
• plugin.yaml → 1.4.3
• README badge + What's New entry
• docker-publish.yml green on the v1.4.3 tag

Files

• Dockerfile — apt install python3-pip + venv loop
• plugin.yaml — version 1.4.3
• README.md — version badge + What's New entry