Install the image's Ubuntu packages from the normal mirrors (closes #190)

The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone.

Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

docs/image.md

@@ -8,8 +8,7 @@ is pinned that way.
 ## Contents
 
 - Ubuntu 26.04 LTS, pinned by digest.
-- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
-  archive at `20261001T000000Z`.
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's archive.
 - Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
   `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
   Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
@@ -26,10 +25,8 @@ is pinned that way.
 
 ## Pins
 
-- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
-  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
-  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
-  `apt-get update`. The hashes are the amd64 archive's.
+- Ubuntu's packages are not pinned: they come from the live archive, whose
+  packages change with every update.
 - nixpkgs: the release file `nixexprs.tar.xz` of
   `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
   SHA-256 hash.