add Virtual environments page (project isolation + pyenv)

New docs/environments.md, nav 'Virtual environments' (before Deploy):
- the rule: never touch system Python (danger callout)
- project-based isolation as Local .venv / Makefile-driven / Docker tabs,
  each with a runnable snippet; Docker ties back to the deploy standard
- local dev with pyenv: why, official install link, shell init with
  annotated lines, everyday use, per-project .python-version
- shell quality-of-life extras (flake8 alias, .local/bin + npm-global PATH),
  cross-ref'd to Standards and Workflow

workflow.md pyenv bullet now points at the new page; index.md gains a card.

Verified in-browser: tabs switch (Local/Makefile/Docker), annotations and
admonitions render; mkdocs build --strict clean (cross-ref anchors resolve).

Signed-off-by: disqualifier <dev@disqualifier.me>

docs/workflow.md

@@ -171,8 +171,9 @@ works by running it** — don't accept "this should work."
   [Remote — WSL](https://code.visualstudio.com/docs/remote/wsl), and run
   [Claude Code](https://docs.claude.com/en/docs/claude-code/overview) as your
   agent (terminal or the VS Code extension).
-- **[pyenv](https://github.com/pyenv/pyenv)** for Python versions — per-project
-  versions, we target Python **3.10+**.
+- **[pyenv](https://github.com/pyenv/pyenv)** for per-project Python versions
+  (we target **3.10+**) and isolated `.venv`s — full setup on the
+  [Virtual environments](environments.md) page.
 - **[flake8](https://flake8.pycqa.org/)** with a shared config — max line length
   **120** (see the alias below).