fix(packages): trust public APT TLS

[jmgilman]

Summary

• install Debian CA certificates from the image’s signed upstream repositories before replacing sources for public HTTPS verification
• leave network-disabled local repository verification unchanged

Verification

• go test ./internal/adapter/pkginstall ./internal/stage/pkgrepo ./internal/cli
• focused golangci-lint returned 0 issues
• pinned Debian Docker smoke test installed release-cli=0.1.9 from https://pkgs.meigma.dev/apt
• production replay passed all local APT/RPM/APK installs and isolated the public failure to the base image’s missing CA bundle