feat: opt-out switch for prestartup pip install/upgrade

Add a `dependency_management` config key (and matching
`COMFYUI_MANAGER_DEPENDENCY_MANAGEMENT` env override) so installs on
externally-managed Python environments — Nix, Guix, system packages,
locked-down corporate images — can disable every prestartup path that
mutates the interpreter.

When set to `off`:
- `PIPFixer.fix_broken()` returns immediately (no torch/opencv/comfy
  rollback, no `comfyui-frontend-package` reinstall).
- The unified dependency resolver is skipped before it tries to
  `uv pip install` against a read-only store.
- Per-node `pip install -r requirements.txt` in
  `execute_lazy_install_script` is skipped.

Read-only operations (`pip list`, `pip freeze`, `pip show`) still run,
so the UI, inventory, and security checks keep functioning. Default is
`on`, preserving today's behavior for every existing user.

comfyui_manager/common/manager_util.py

@@ -28,6 +28,17 @@ use_uv = False
 use_unified_resolver = False
 bypass_ssl = False
 
+# When False, ComfyUI-Manager will not attempt to install, upgrade, or
+# uninstall Python packages on its own (prestartup auto-healing, the unified
+# dependency resolver, and per-node `pip install -r requirements.txt`). This
+# is intended for distro-packaged or otherwise externally-managed Python
+# environments (e.g. Nix, Guix, system package managers, locked-down
+# corporate images) where the interpreter is read-only.
+#
+# Read-only pip operations (`list`, `freeze`, `show`) still run so the UI,
+# inventory, and security checks keep working.
+dependency_management_enabled = True
+
 def is_manager_pip_package():
     return not os.path.exists(os.path.join(comfyui_manager_path, '..', 'custom_nodes'))
 
@@ -412,6 +423,10 @@ class PIPFixer:
         self.manager_files_path = manager_files_path
 
     def fix_broken(self):
+        if not dependency_management_enabled:
+            logging.info("[ComfyUI-Manager] dependency management disabled; skipping PIPFixer.fix_broken()")
+            return
+
         new_pip_versions = get_installed_packages(True)
 
         # remove `comfy` python package