Quiet the update-alternatives man page warnings in the image build (closes #222)

xz-utils' install, which nix-bin depends on, calls update-alternatives to
link its man pages, but the image's dpkg config drops man pages the moment
they unpack, so it prints one warning for each link it cannot make. A config
file read after that one re-includes man pages for this install alone; the
cleanup then removes the man pages and the links and directories they added,
so the image holds exactly what it held before, and installs built from it
still drop them.

Model: deepseek-v4-pro

Dockerfile

@@ -136,10 +136,26 @@ RUN mkdir /etc/sysusers.d \
 # ca-certificates, nix-bin and runit, from Ubuntu's archive. apt fetches
 # them over plain HTTP and checks each one against the archive's signed
 # package lists, so no CA certificates are needed.
-RUN apt-get update \
+#
+# The image's dpkg config drops man pages as each package unpacks, so
+# xz-utils' install, which nix-bin depends on, prints an update-alternatives
+# warning for every man-page link it cannot make. This side file re-includes
+# them for this install alone; it is read after /etc/dpkg/dpkg.cfg.d/excludes,
+# so it overrides the drop and the links are made quietly. The cleanup below
+# removes the man pages and the links and directories they added, then puts
+# the base image's empty man directories back. The image holds exactly what
+# it held before, and installs built from it still drop man pages.
+RUN find /usr/share/man -mindepth 1 -type d > /tmp/base-man-dirs \
+    && echo 'path-include=/usr/share/man/*' > /etc/dpkg/dpkg.cfg.d/z-man \
+    && apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
         ca-certificates nix-bin runit \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* /etc/dpkg/dpkg.cfg.d/z-man \
+    && find /usr/share/man ! -type d -delete \
+    && find /etc/alternatives -type l -xtype l -delete \
+    && find /usr/share/man -mindepth 1 -type d -empty -delete \
+    && xargs -a /tmp/base-man-dirs mkdir -p \
+    && rm /tmp/base-man-dirs
 
 # Nix run by root expects a group of build users, which nix-bin does not
 # create; with the setting empty, root's builds run without them.