fix: move dep checks into scripts/check_deps.sh for robustness

Replaces fragile one-liner Makefile chain with a proper shell script.
Tries: sudo -n apt → python3 -m pip --user → get-pip.py bootstrap.
Prints a clear manual-install message if all automated paths fail.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/check_deps.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+# Install Python dependencies needed by setup_cell.py
+set -e
+
+echo "Checking system dependencies..."
+
+# Ensure python3 is available
+if ! command -v python3 >/dev/null 2>&1; then
+    echo "Installing python3..."
+    sudo apt-get install -y python3 || { echo "ERROR: python3 not found and could not install it."; exit 1; }
+fi
+
+# Check if cryptography is already importable
+if python3 -c "import cryptography" 2>/dev/null; then
+    echo "Dependencies OK."
+    exit 0
+fi
+
+echo "Installing python3-cryptography..."
+
+# 1. Try apt (works if sudo is passwordless or interactive TTY is available)
+if sudo -n apt-get install -y python3-cryptography 2>/dev/null; then
+    echo "Dependencies OK."
+    exit 0
+fi
+
+# 2. Try pip (module form, covers both pip3 and python3 -m pip)
+if python3 -m pip install --user cryptography 2>/dev/null; then
+    echo "Dependencies OK."
+    exit 0
+fi
+
+# 3. Bootstrap pip via get-pip.py, then install
+if command -v curl >/dev/null 2>&1; then
+    curl -sSL https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py 2>/dev/null \
+        && python3 /tmp/get-pip.py --user -q 2>/dev/null \
+        && python3 -m pip install --user cryptography 2>/dev/null \
+        && { echo "Dependencies OK."; exit 0; }
+fi
+
+# 4. No automated path worked — ask the user to install manually
+echo ""
+echo "ERROR: Could not install python3-cryptography automatically."
+echo "Please run the following command and then retry:"
+echo ""
+echo "  sudo apt-get install -y python3-cryptography"
+echo ""
+exit 1