fix: run apt-get update before every apt-get install

[ramonskie]

Problem

Ubuntu point-release supersessions cause 404 errors when a Docker image's apt package index is stale. The immediate trigger was libgdk-pixbuf2.0-bin/libgdk-pixbuf-2.0-dev version .4 being superseded by .5 on the Ubuntu jammy mirrors — these are transitive dependencies pulled in by libmagickwand-dev/libmagickcore-dev during PHP builds:

Err:16 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 libgdk-pixbuf2.0-bin amd64 2.42.8+dfsg-1ubuntu0.4
  404  Not Found
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
binary-builder: building php: php: apt install php_build: ... exit status 100

This can happen to any recipe that installs packages, not just PHP.

Fix

Move apt-get update inside APT.Install() so every install call automatically refreshes the package index before installing. No call-site changes are needed — all recipes (php, ruby, python, node, r, httpd, hwc, autoconf, compiler) benefit unconditionally.

func (a *APT) Install(ctx context.Context, packages ...string) error {
    if len(packages) == 0 {
        return nil
    }
    if err := a.Update(ctx); err != nil {
        return fmt.Errorf("apt-get update: %w", err)
    }
    // ...
}

Notes

• AddPPA still does its own apt-get update after adding the repo (necessary to pick up the new PPA sources). This means GCC.Setup runs update 3 times on cflinuxfs4 — harmless.
• InstallReinstall is unchanged (used only for downloading .deb files in the Python recipe; same stale-index risk applies but that path is less exposed).
• All 16 test packages pass.

[ivanovac]

lgtm