fix(build): stabilize mem0 arm64 apt bootstrap

[JSONbored]

Summary

• harden the Ubuntu apt bootstrap used by the mem0 image build on arm64
• keep HTTPS apt verification while serializing apt access, forcing IPv4, and disabling pipelining
• isolate Docker integration tests from host/OrbStack proxy injection for internal backend traffic

Why

The central publish path was failing/hanging in the linux/arm64 build during HTTPS apt index refresh from ports.ubuntu.com. The previous security hardening correctly restored HTTPS apt sources, but the arm64/QEMU publish environment needed stricter apt transport settings instead of a retry loop that could still stall.

Validation

• uv run --with pytest --with defusedxml pytest tests/template/test_security_defaults.py -> 7 passed
• uv run --with pytest --with defusedxml pytest tests/integration/test_backend_matrix.py::test_external_backend_matrix_persists_memory_across_restart[qdrant] -> 1 passed
• uv run --with pytest --with defusedxml pytest tests/integration/test_backend_matrix.py::test_external_backend_matrix_persists_memory_across_restart[weaviate] -> 1 passed
• uv run --with pytest --with defusedxml pytest -> 23 passed
• docker buildx build --progress=plain --platform linux/arm64 --load -t mem0-aio:arm64-aptfix . -> passed
• python -m aio_fleet.cli validate-repo --repo mem0-aio --repo-path /Users/shadowbook/.codex/worktrees/security-2026-05-09/mem0-aio -> passed
• python -m aio_fleet.cli trunk run --repo mem0-aio --repo-path /Users/shadowbook/.codex/worktrees/security-2026-05-09/mem0-aio --no-fix -> trunk=ok
• git diff --check -> passed

Notes

No release tag is created here; this is a publish-path fix so the existing central package publish can complete for the current main build.