fix(ci): apt-get update before every apt-get install

[h4x0r]

apt-get install with no preceding apt-get update is a time bomb rather
than a flake. The GitHub runner image ships a pre-baked apt list pinning an
exact .deb version; it works until Ubuntu supersedes that version in the
archive, and then the pinned URL 404s on every run until the runner image is
rebuilt:

E: Failed to fetch .../__amd64.deb 404 Not Found
E: Unable to fetch some archives, maybe run apt-get update or try with
--fix-missing?

That is exactly what took out two jobs in vhd-forensic. apt names the fix in
its own error text.

Found by sweeping the fleet after fixing that one repo: 70 install sites
across 10 repos had no preceding update, all latent, each failing on whatever
day its package next gets a security update. This repo's share is fixed here.
Sites that already refresh the lists are untouched.

Verified locally in a container rather than by re-running CI. On ubuntu:24.04,
installing with the image's shipped apt state fails ("E: Unable to locate
package") and the same install succeeds after apt-get update.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

[h4x0r]

Closing: this was a false positive of my own sweep. My detector only looked at the preceding lines for apt-get update, so it missed that these sites already refresh the lists on the SAME line (apt-get update && apt-get install ...). The change added a redundant second update and fixed nothing. Apologies for the noise.