dotfiles: install the common tools every project on these machines expects

ffmpeg, adb and python3-venv join shellcheck in the optional set. They are
common across the projects here rather than specific to any one of them, so
installing them once from this script means a per-project setup script only has
to CHECK for them instead of carrying its own package-manager logic and its own
sudo. That is exactly what RAWcorder's setup-linux-tests.sh now does.

python3-venv is the one that is easy to miss. Debian and Ubuntu split venv and
ensurepip out of python3, so `python3 -m venv` fails on a stock Ubuntu with an
error telling you to apt-get it; Arch bundles both into python, so there is
nothing to add there. Both names go through pick_pkg, like everything else here.

ffprobe is checked but not installed: it has no package of its own and ships
inside ffmpeg, so checking it separately also catches a stripped-down distro
build that leaves it out.

What stays out of this script, and the comment now says so: anything
project-shaped. No virtualenvs, no per-repo Python packages, no test tooling.
Those belong beside the repo that needs them.

Also fixes a latent SC2318 in install_agi_deb. It read

    local ver="$1" tmp="$2" deb="$tmp/agi.deb" depends

and the words of a `local` are expanded before `local` runs, so $tmp there is
the OUTER scope's tmp, not the parameter being assigned beside it. The caller
passes AGI_TMP and no outer tmp exists, so deb resolved to "/agi.deb" -- the
download would have landed in the filesystem root, which the sudo re-exec would
have permitted. Never observed, because AGI has not been installed from the .deb
path on this machine. The script passes shellcheck on itself again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GXBBHFrwVKRsAMhtS7EkCR