bug(ansible): deploy.yml standalone redeploy skips python312 prerequisite — python3.12 not found on fresh hosts

[mrveiss]

Summary

autobot-slm-backend/ansible/deploy.yml (the standalone role-redeploy playbook) applies the ai-stack and backend roles directly with no python312 prerequisite step. On a host that was enrolled after the initial fleet provisioning (or re-imaged), python3.12 will not be present and the venv creation step will fail:

fatal: [hostname]: FAILED! => {"msg": "python3.12: command not found"}

This gap became observable after PR #3536 changed ai-stack from python3 -m venv to python3.12 -m venv. The backend role has the same assumption.

Root Cause

playbooks/provision-fleet-roles.yml correctly applies python312 in Phase 0 before ai-stack (Phase 5a) and backend (Phase 4a):

# Phase 0: Shared Dependencies (nginx, python312, nodejs)
- name: python312
  when: "'python312' in (node_dependencies | default([]))"

But deploy.yml has no such guard:

# deploy.yml — no python312 step
- name: Deploy ai-stack role       # line 59-62
  include_role: { name: ai-stack }
  when: "'ai-stack' in role_list"

- name: Deploy backend role        # line 46
  include_role: { name: backend }
  when: "'backend' in role_list"

Fix

Add a conditional python312 pre-step to deploy.yml that runs when ai-stack or backend is in role_list:

- name: Ensure Python 3.12 is available (required by backend and ai-stack)
  include_role:
    name: python312
  when: >-
    'backend' in role_list or
    'ai-stack' in role_list

This mirrors what provision-fleet-roles.yml already does.

Discovered During

PR #3536 — ai-stack venv fix (changing python3 to python3.12). Pre-existing gap made visible by that change.