Install the image's Ubuntu packages from the normal mirrors (closes #190)

The final image stage now apt-gets ca-certificates, nix-bin and runit
from the archive the image's own sources name, with no snapshot and no
hash check of the package lists. The borrowed CA bundle is dropped: the
archive is reached over plain HTTP, so the install needs none. The Ubuntu
base image stays pinned by digest, and every other pin is kept. SPEC.md
and docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro

SPEC.md

@@ -1544,20 +1544,12 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
 
 - The image is Ubuntu's newest long-term support release, pinned by digest, and
   moves to the next LTS release when that ships. Its packages come from Ubuntu's
-  snapshot service, the archive as it was at the moment the Dockerfile names,
-  rather than the live archive, whose packages change with every update. The
-  snapshot is never older than the pinned Ubuntu image, since older packages can
-  need older versions of packages the image holds, and it moves forward with the
-  image's digest. The Dockerfile names the hash of each of the snapshot's
-  `InRelease` files, which cover every package list and so every package, and
-  the build checks them before installing. The live archive's `InRelease` files,
-  which `apt-get update` also fetches and the install does not use, are left out
-  of the check. The hashes are the amd64 archive's, so the image is built for
-  amd64 only.
+  normal mirrors, the live archive the image's own sources name, whose packages
+  change with every update.
 - The Ubuntu image has no CA certificates. Without them Nix cannot download
   packages and `servewaf` cannot reach GeoJS, so `ca-certificates` is installed
-  by name. The snapshot itself is fetched over HTTPS with the CA certificates of
-  the Go image that builds `smallwebwaf`, itself pinned by digest.
+  by name. The archive is reached over plain HTTP, so the install needs no CA
+  certificate from the builder.
 - nixpkgs comes from a release file on `releases.nixos.org`, named with its
   hash, not from a GitHub archive, whose bytes can change. Root uses Nix
   directly; no Nix daemon runs. `nix-bin` creates no build users, so