fix(nix): give the dev shell the interpreter and headers the catalogue needs

The dev shell's interpreter is the one `pkgmgr update --all` installs every
repository in the catalogue with, so it has to satisfy their floors rather than
only this project's. portfolio declares requires-python >=3.12, which 3.11 does
not resolve; the package block moves along with the shell because the comment
there promises they are the same version.

ldap-schema-manager pulls python-ldap, which compiles against lber.h and ldap.h
from OpenLDAP plus the SASL headers and locates them through pkg-config. None
of the three were in buildInputs, so that repository failed in the compiler
rather than in the resolver.

Both are failures of the same sweep, and both are environment rather than code.

Verified: a full `pkgmgr update --all` sweep in the arch image against this
flake, with 0 installation failures.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

flake.nix

@@ -26,8 +26,8 @@
       packages = forAllSystems (system:
         let
           pkgs = nixpkgs.legacyPackages.${system};
-          python = pkgs.python311;
-          pyPkgs = pkgs.python311Packages;
+          python = pkgs.python312;
+          pyPkgs = pkgs.python312Packages;
         in
         rec {
           pkgmgr = pyPkgs.buildPythonApplication {
@@ -79,8 +79,8 @@
             if pkgs ? ansible-core then pkgs.ansible-core
             else pkgs.ansible;
 
-          # Use the same Python version as the package (3.11)
-          python = pkgs.python311;
+          # Use the same Python version as the package
+          python = pkgs.python312;
 
           pythonWithDeps = python.withPackages (ps: [
             ps.pip
@@ -95,6 +95,9 @@
               pkgs.git
               pkgs.gnupg
               ansiblePkg
+              pkgs.pkg-config
+              pkgs.openldap
+              pkgs.cyrus_sasl
             ];
 
             shellHook = ''