build(deploy): provision Python 3.14 in Ansible + finish deploy-path sweep (#10872 Tier 2)

[mrveiss]

Closes #10884.

Thinking Path

The Docker images run Python 3.14, but the Ansible deploy path (which provisions venvs directly on hosts via deadsnakes PPA) still provisioned and asserted python3.12. This finishes the migration for the non-container deploy path.

What Changed

Ansible provisioning (SLM + backend):

• agent_config/defaults/main.yml, inventory/production.yml, group_vars/backend.yml: python_version 3.12→3.14
• slm_manager/tasks/main.yml: venv version asserts 3.12→3.14 — fixes a real bug: the assert was pinned to '3.12' while the venv was already created with python3.14 -m venv, so every deploy run needlessly tore down + rebuilt the venv and the health check never ran. Now idempotent.
• manifest.yml: deadsnakes runtime note → 3.14

Deploy-path scripts / config:

• .python-version (root + autobot-infrastructure/shared/config/) → 3.14
• shared/scripts/setup-runner-python.sh, install-bare-metal.sh: deadsnakes install/venv 3.12→3.14
• shared/scripts/cleanup-legacy-python.sh: keep-version safety gate 3.12→3.14 (the version it protects, not removes — leaving it at 3.12 would abort on a correctly-migrated host)
• autobot-infrastructure/autobot-backend/README.md: current-runtime prose → 3.14

Intentionally NOT bumped (documented):

• NPU Worker python3.11 in deploy-native-services.yml + production.yml — pinned for OpenVINO (no 3.14 wheels). Added inline comments so future audits don't trip on it.
• Dependency pins (aiohttp>=3.12.15, keras 3.12.0) — package versions, not the interpreter.

Verification

• All changed YAML parses via yaml.safe_load_all; bash -n clean on all 3 scripts.
• grep confirms no residual interpreter 3.12 refs in the bumped files.
• Base merge from Dev_new_gui (picking up perf(reliability): FailurePatternDetector uses sync Redis on async paths #10635) was clean.

Model Used

Opus 4.8

Part of #10872 (Tier 2). Follow-up doc-sweep for remaining 3.12 doc/test mentions to be filed separately.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!