now that latest ubuntu/debian forbid this too, and pipx exists to easily
install things into a venv, we should do the same.

reverts f57181f6
reinstates 40d10fdd