fix: add --break-system-packages for pip installs + pip.conf bypass PEP 668

- Dockerfile: add /etc/pip/pip.conf with break-system-packages=true
- run_agent: use --break-system-packages flag when installing requirements.txt
- Fixes agent dependency installation on Debian bookworm containers

Author: echobt

Dockerfile

@@ -41,6 +41,9 @@ RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
 ENV PATH="/root/.cargo/bin:${PATH}"
 
+# Allow pip to install packages system-wide (bypass PEP 668)
+RUN mkdir -p /etc/pip && printf '[global]\nbreak-system-packages = true\n' > /etc/pip/pip.conf
+
 # Create non-root 'agent' user to run the executor and all agent code.
 # Basilica containers have no_new_privs, so sudo is unavailable at runtime.
 # All system deps must be pre-installed above (as root during build).

src/executor.rs

@@ -597,7 +597,7 @@ async fn run_agent(
         if agent_dir.join("requirements.txt").exists() {
             info!("Installing agent requirements.txt");
             let (_, stderr, exit) = run_shell(
-                "pip install -q -r requirements.txt 2>&1 || pip3 install -q -r requirements.txt 2>&1 || true",
+                "pip install --break-system-packages -q -r requirements.txt 2>&1 || pip3 install --break-system-packages -q -r requirements.txt 2>&1 || true",
                 &agent_dir,
                 Duration::from_secs(120),
                 None,