Install the image's Ubuntu packages from the normal mirrors (closes #190)

The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone.

Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

SPEC.md

@@ -1544,20 +1544,11 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
 
 - The image is Ubuntu's newest long-term support release, pinned by digest, and
   moves to the next LTS release when that ships. Its packages come from Ubuntu's
-  snapshot service, the archive as it was at the moment the Dockerfile names,
-  rather than the live archive, whose packages change with every update. The
-  snapshot is never older than the pinned Ubuntu image, since older packages can
-  need older versions of packages the image holds, and it moves forward with the
-  image's digest. The Dockerfile names the hash of each of the snapshot's
-  `InRelease` files, which cover every package list and so every package, and
-  the build checks them before installing. The live archive's `InRelease` files,
-  which `apt-get update` also fetches and the install does not use, are left out
-  of the check. The hashes are the amd64 archive's, so the image is built for
-  amd64 only.
+  archive, whose packages change with every update.
 - The Ubuntu image has no CA certificates. Without them Nix cannot download
   packages and `servewaf` cannot reach GeoJS, so `ca-certificates` is installed
-  by name. The snapshot itself is fetched over HTTPS with the CA certificates of
-  the Go image that builds `smallwebwaf`, itself pinned by digest.
+  by name. apt fetches the packages over plain HTTP and checks each one against
+  the archive's signed package lists, so the install needs no CA certificates.
 - nixpkgs comes from a release file on `releases.nixos.org`, named with its
   hash, not from a GitHub archive, whose bytes can change. Root uses Nix
   directly; no Nix daemon runs. `nix-bin` creates no build users, so