fix(ci): recreate venv after cache restore to fix absolute symlinks

Running python3 -m venv venv over an existing cached venv recreates
the absolute symlinks and pyvenv.cfg paths so Python resolves to
the current system's python3 binary. Without this, cp -a preserves
stale symlinks from the cache source, causing venv/bin/python to
resolve to /usr/bin/python3 (system, not venv) and pytest not found.

Also switch validation to use python3 to match Ubuntu 24.04 convention.

CLAUDE.md

@@ -13,10 +13,15 @@
 - Sidebar: categorized as Main (Overview, Docker, Files, Terminal), Media (Navidrome, Jellyfin, Audiobookshelf, Immich), Tools (OpenClaw, Repos, Gitea Web, Stirling PDF, Vaultwarden, Speedtest)
 - New pages: create route in `src/routes/`, import in `App.svelte`, add to appropriate category in `Sidebar.svelte`
 
-## Build & Deploy
-- Build images on Mac: `docker build --platform linux/amd64`
-- Transfer: `docker save <image> | ssh zjgump@100.78.131.124 "/volume1/@appstore/ContainerManager/usr/bin/docker load"`
-- Deploy: `git push` triggers Gitea Actions CI (`docker compose up -d --pull never`) — do NOT manually restart
+## Authentication
+- **Gitea API Access:** Use a dedicated `claude-ci-bot` user with a Personal Access Token (PAT).
+- **Secret Management:** Store the PAT in an environment variable `GITEA_TOKEN`. Avoid hardcoding paths to secret files.
+- **Project Secrets:** Keep sensitive configurations (like the PAT) in a local `.env` file that is ignored by git.
+
+- Build images on VPS (server2) to avoid NAS HDD I/O saturation:
+  1. Build on VPS with Podman
+  2. Stream image to NAS: `podman save <image> | ssh nasts "/volume1/@appstore/ContainerManager/usr/bin/docker load"`
+  3. Deploy: `git push` triggers Gitea Actions CI (builds on VPS, transfers, then `docker compose up`) — do NOT manually restart
 - CI workflows are in `.gitea/workflows/` in this repo
 
 ## claude-dev CI Contract