Quiet the update-alternatives man page warnings in the image build (closes #222)

xz-utils' install calls update-alternatives to link its man pages, but the
image's dpkg config drops man pages the moment they unpack, so it prints
one warning for each link it cannot make. A config file read after that one
re-includes man pages for this install alone, so the links are made
quietly; the man pages and that file are then removed, so the image still
holds none, and installs built from it still drop them.

Model: deepseek-v4-pro

Dockerfile

@@ -136,10 +136,19 @@ RUN mkdir /etc/sysusers.d \
 # ca-certificates, nix-bin and runit, from Ubuntu's archive. apt fetches
 # them over plain HTTP and checks each one against the archive's signed
 # package lists, so no CA certificates are needed.
-RUN apt-get update \
+#
+# The image's dpkg config drops man pages as each package unpacks, so
+# xz-utils' install prints an update-alternatives warning for every man-page
+# link it cannot make. This side file re-includes them for this install
+# alone; it is named to be read after /etc/dpkg/dpkg.cfg.d/excludes, so it
+# overrides that drop. The man pages and the side file are removed again
+# below, so the image keeps no man pages, and installs built from it still
+# drop them.
+RUN echo 'path-include=/usr/share/man/*' > /etc/dpkg/dpkg.cfg.d/z-man \
+    && apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
         ca-certificates nix-bin runit \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* /usr/share/man /etc/dpkg/dpkg.cfg.d/z-man
 
 # Nix run by root expects a group of build users, which nix-bin does not
 # create; with the setting empty, root's builds run without them.