chore(session): harden chroot package installs (PATH + apt-get update)

- chroot_bash exports a Debian-safe PATH so /usr/sbin tools (update-initramfs,
  useradd, chpasswd, ...) resolve inside the chroot instead of failing with
  code 127.
- install_packages runs apt-get update before install (a stock image ships
  stale lists whose superseded .deb URLs 404) and non-interactive
  apt-get install -y; pacman gains -Sy for the same index-refresh reason.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_tor.py

@@ -189,7 +189,7 @@ class TestInitramfsToolsBackend:
         apt = [
             text
             for _, _, text in fake_runner.calls
-            if text and "apt install" in text and "tor busybox" in text
+            if text and "apt-get install" in text and "tor busybox" in text
         ]
         assert len(apt) == 1