Refresh apt package lists once in script/bootstrap (closes #115)

pkg_install ran apt-get install without apt-get update. The Gitea runner
image starts with empty package lists, so installing anything it lacks,
such as Go, failed with "Unable to locate package". The apt branch now
runs apt-get update before its first install and skips it on later
calls, so a repository's own section needs no refresh of its own.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -1,18 +1,9 @@
 name: check
 on: [push]
-# Free the shared runner: a new push cancels only the same branch's older run.
-concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-              # script/cibuild needs no token, so none is left in .git/config.
-              with:
-                  persist-credentials: false
-                  # All history and tags, so git describe finds the version tag.
-                  fetch-depth: 0
             - run: script/cibuild

TODO.md

@@ -21,34 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
-  `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
-  and tags that `git describe --tags --always` needs, and a tagged repository
-  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both
-  checklists name `fetch-depth: 0` among what the workflow does, next to
-  `persist-credentials: false` and the `concurrency` block, instead of asking
-  each tagged repository to add it. Not yet tried on the shared runner, which is
-  out of disk space. Repositories pick this up on their next re-vendor.
 - 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
   before the first `apt-get install` of a run (issue 115). The Gitea runner
   image starts with empty package lists, so installing anything it lacks, such
   as Go, failed with `Unable to locate package`. A repository's own section no
   longer needs a refresh of its own; `sneak/bsfirehose` and `sneak/dnswatcher`
   drop theirs at their next re-vendor.
-- 2026-10-06: `REPO_POLICIES.md` and both checklists now say that a checkout
-  whose `.git` is a file, a linked worktree or a repository checked out as a
-  submodule, is the exception to a plain `docker build .` succeeding (issue
-  111): that file points to a git directory outside the build context, so the
-  build cannot read the version and the version check in the canonical
-  `Dockerfile` stops it. Such a build is given its version with
-  `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already do.
-  The check itself is unchanged.
-- 2026-10-06: The canonical `.gitea/workflows/check.yml` now has a `concurrency`
-  block, so a new push cancels the older run on the same branch and no other,
-  and its checkout step sets `persist-credentials: false`, so the job's token is
-  not left in `.git/config` (issue 107). `REPO_POLICIES.md` and both checklists
-  describe the workflow as it now is. Not yet tried on the shared runner, which
-  is out of disk space. Repositories pick this up on their next re-vendor.
 - 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
   (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
   package that also calls `ResponseWriter.Header()`, so the same tree can fail

prompts/EXISTING_REPO_CHECKLIST.md

@@ -91,20 +91,12 @@ with your task.
       version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
+      `script/docker` and `script/cibuild` pass the version they compute on the
-      checked out as a submodule) is the exception: that file points to a git
+      host; it takes precedence. A tag-derived version additionally needs
-      directory outside the build context, so the build cannot read the version
+      `fetch-depth: 0` on the CI checkout step, which clones shallow and fetches
-      and a plain `docker build .` fails; pass the version with
+      no tags by default.
-      `--build-arg VERSION=...`. `script/docker` and `script/cibuild` already
-      pass the version they compute on the host; it takes precedence. The
-      canonical `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its
-      checkout step, which otherwise clones shallow and fetches no tags, so a CI
-      build finds the tag too.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
-      push, checks out with `persist-credentials: false` and with
+      push — reference
-      `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      carries the `concurrency` block that lets a new push cancel only the same
-      branch's older run — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
     - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from

prompts/NEW_REPO_CHECKLIST.md

@@ -97,12 +97,6 @@ Template files can be fetched from:
       version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
-      checked out as a submodule) is the exception: that file points to a git
-      directory outside the build context, so the build cannot read the version
-      and a plain `docker build .` fails; pass the version with
-      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
-      do.
     - The Dockerfile carries a `lint` phase and a `test` phase, each invoking
       its tool directly rather than through `make` or `script/`, and the final
       stage carries a `COPY --from=` of a harmless file from each so the image
@@ -112,10 +106,7 @@ Template files can be fetched from:
     - Non-server: the final stage brings up the dev environment
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
-      `script/cibuild` on push, checks out with `persist-credentials: false` and
+      `script/cibuild` on push — reference
-      with `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      carries the `concurrency` block that lets a new push cancel only the same
-      branch's older run — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from

prompts/REPO_POLICIES.md

@@ -281,26 +281,11 @@ style conventions are in separate documents:
       `.git` and the version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
-      checked out as a submodule) is the exception: that file points to a git
-      directory outside the build context, so the build cannot read the version
-      and a plain `docker build .` fails; pass the version with
-      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
-      do.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step,
+  runs `script/cibuild` on push, and checks out the repo as its only other step.
-  with `persist-credentials: false`: `script/cibuild` needs no token, and
+  That script bootstraps, runs the gate phases, and then builds the image, so a
-  without it the checkout leaves the job's token in `.git/config` for every
+  successful run means every check passed; a bare `docker build .` does not
-  later step. The checkout step also sets `fetch-depth: 0`, which fetches the
-  tags `git describe` needs: by default it clones shallow with no tags, and a
-  tagged repository's CI build would stamp a bare short commit id. The
-  workflow's `concurrency` block groups runs by workflow and branch
-  (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
-  so a new push cancels the older run on the same branch, queued or running, and
-  no other: runs for replaced commits do not hold up the shared runner.
-  `script/cibuild` bootstraps, runs the gate phases, and then builds the image,
-  so a successful run means every check passed; a bare `docker build .` does not
   carry the same guarantee, because its gate phases may come from the cache. The
   image build is uncached and so runs the gate phases a second time. That is the
   price of the rule above, and it is worth paying: the image that ships is built
@@ -475,8 +460,8 @@ style conventions are in separate documents:
     there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
     Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
     the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so the canonical
+    checkout action clones shallow and fetches no tags, so a repo that embeds a
-    `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its checkout step.
+    tag-derived version must set `fetch-depth: 0` on its checkout step.
 
 - **Verify `.dockerignore` by enumerating the image, not by reading the
   patterns.** Plant files at the root _and_ at least two directories deep, build