chore(session): harden chroot package installs (PATH + apt-get update)

- chroot_bash exports a Debian-safe PATH so /usr/sbin tools (update-initramfs,
  useradd, chpasswd, ...) resolve inside the chroot instead of failing with
  code 127.
- install_packages runs apt-get update before install (a stock image ships
  stale lists whose superseded .deb URLs 404) and non-interactive
  apt-get install -y; pacman gains -Sy for the same index-refresh reason.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_image_setup.py

@@ -101,7 +101,8 @@ class TestInstallPackages:
             for kind, cmd, input_text in fake_runner.calls
             if kind == "run" and cmd[0] == "chroot"
         ]
-        assert chroot_calls == ["pacman --noconfirm -S --needed btrfs-progs"]
+        assert len(chroot_calls) == 1
+        assert "pacman --noconfirm -Sy --needed btrfs-progs" in chroot_calls[0]
 
     def test_apt_for_retropie(self, tmp_path, fake_runner):
         install_packages("retropie", tmp_path, "btrfs-progs")
@@ -110,7 +111,9 @@ class TestInstallPackages:
             for kind, cmd, input_text in fake_runner.calls
             if kind == "run" and cmd[0] == "chroot"
         ]
-        assert chroot_calls == ["yes | apt install btrfs-progs"]
+        assert len(chroot_calls) == 1
+        assert "apt-get update" in chroot_calls[0]
+        assert "apt-get install -y btrfs-progs" in chroot_calls[0]
 
     def test_unsupported_distribution_raises(self, tmp_path, fake_runner):
         with pytest.raises(LimError):

tests/unit/test_tor.py

@@ -189,7 +189,7 @@ class TestInitramfsToolsBackend:
         apt = [
             text
             for _, _, text in fake_runner.calls
-            if text and "apt install" in text and "tor busybox" in text
+            if text and "apt-get install" in text and "tor busybox" in text
         ]
         assert len(apt) == 1