Install the image's Ubuntu packages from the normal mirrors (closes #190)

The final image stage now apt-gets ca-certificates, nix-bin and runit
from Ubuntu's archive, with no snapshot and no hash check of the package
lists. The borrowed CA bundle is dropped: apt fetches the packages over
plain HTTP and checks each one against the archive's signed package
lists, so the install needs none. The Ubuntu base image stays pinned by
digest, and every other pin is kept. README.md, SPEC.md and
docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

README.md

@@ -663,9 +663,9 @@ aside as `<name>.bad`, and never stops the running process (see
 ### The image and its processes
 
 - The image is built on Ubuntu 26.04 LTS, pinned by digest, with its packages
-  from a snapshot of Ubuntu's archive and nixpkgs fixed at one release. An app's
-  `Dockerfile` installs a package with `nix-env -iA nixpkgs.<name>` and gets the
-  same package each time it is built (see [`docs/image.md`](docs/image.md)).
+  from Ubuntu's archive and nixpkgs fixed at one release. An app's `Dockerfile`
+  installs a package with `nix-env -iA nixpkgs.<name>` and gets the same package
+  each time it is built (see [`docs/image.md`](docs/image.md)).
 - runit, a service supervisor, runs `smallwebwaf` as the `smallwebwaf` user (uid
   and gid 65532) and starts it again when it exits. The `run` script of
   `servewaf` gives the state directory to the `smallwebwaf` user at each start,