Install the image's Ubuntu packages from the normal mirrors (closes #190)

The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone.

Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

README.md

@@ -69,8 +69,7 @@ Not built, and not planned:
 ### The image
 
 No image is published. Build it from a clone. `make docker` runs the tests and
-the linter, then builds the image, tagged `smallwebwaf`. It builds for amd64, on
-an amd64 host only.
+the linter, then builds the image, tagged `smallwebwaf`.
 
 ```sh
 git clone https://git.eeqj.de/sneak/smallwebwaf.git
@@ -662,8 +661,8 @@ aside as `<name>.bad`, and never stops the running process (see
 
 ### The image and its processes
 
-- The image is built on Ubuntu 26.04 LTS, pinned by digest, with its packages
-  from a snapshot of Ubuntu's archive and nixpkgs fixed at one release. An app's
+- The image is built on Ubuntu 26.04 LTS, pinned by digest. Its Ubuntu packages
+  come from Ubuntu's archive, and nixpkgs is fixed at one release. An app's
   `Dockerfile` installs a package with `nix-env -iA nixpkgs.<name>` and gets the
   same package each time it is built (see [`docs/image.md`](docs/image.md)).
 - runit, a service supervisor, runs `smallwebwaf` as the `smallwebwaf` user (uid