feat: enhance Ubuntu rootfs build process with improved logging and error handling

DEVELOPER.md

@@ -211,7 +211,8 @@ Default runtime storage is `/var/lib/uvm`:
 │   └── jailer
 ├── images/
 │   ├── vmlinux
-│   └── ubuntu.ext4
+│   ├── ubuntu.ext4
+│   └── ubuntu-build.log
 ├── vms/
 │   └── vm-<uuid>/
 │       ├── rootfs.ext4
@@ -713,10 +714,17 @@ Explicit kernel/rootfs URLs and trusted digests must match the host architecture
 uses an uncompressed Linux `Image` (PE format) and an ARM64 ext4 rootfs.
 
 The default rootfs builder installs `debootstrap` and `ubuntu-keyring`, uses
-`--force-check-gpg`, and includes main/universe plus updates/security suites.
+`--force-check-gpg`, and bootstraps only the base release's main component with
+CA certificates and the Ubuntu keyring. Do not pass updates/security as
+`--extra-suites`: debootstrap can download base archives but import newer
+pre-dependency metadata, producing an empty `dpkg --install` invocation.
+After bootstrap, apt sees main/universe plus updates/security, runs update
+with `APT::Update::Error-Mode=any`, upgrades the base, and installs guest packages.
 amd64 uses `archive.ubuntu.com/ubuntu`; arm64 uses `ports.ubuntu.com/ubuntu-ports`.
-Package scripts execute in private mount/PID namespaces with a temporary
-`policy-rc.d` suppressing service startup. No mounts survive the build process.
+Both phases execute in private mount/PID namespaces. The apt phase has private
+dev/proc and read-only sys mounts, and recreates `policy-rc.d` to suppress service
+startup after Ubuntu's debootstrap script removes it. Cleanup tolerates an
+already-removed policy file. No mounts survive the build process.
 The staged tree retains `/var/lib/dpkg` and apt metadata, validates installed
 apt/sudo/sshd/systemd packages, enables SSH/networkd, preserves kernel-provided
 static networking, and supplies guest DNS. Template host keys and machine IDs
@@ -729,6 +737,11 @@ permit reuse of a built template. Old demo images and unverified caches are
 rebuilt, and `install --force` always rebuilds. A failed staging build retains
 the old template. Installation holds the existing operation lock throughout;
 existing VM disks are never upgraded or reprovisioned by installation.
+Stage command output and debootstrap's detailed log are atomically saved to
+`images/ubuntu-build.log` (mode `0600`) on success or failure before deleting
+staging files. Errors name that durable log; the last lines contain the latest
+stage's diagnostics and failure summary. The recipe marker is bumped whenever
+the build workflow changes so an earlier cached template cannot skip it.
 
 The host package list includes `nftables` and `conntrack` as well as the
 existing iproute2/iptables, ext4, OpenSSL, OpenSSH, download, and util-linux
@@ -924,7 +937,10 @@ growth, shrinking, geometry, and retained data/password-hash/host-key fixtures.
 UID/GID allocation, account/home metadata, existing accounts, and password hashes.
 `test_install.py` simulates package bootstrap and exercises real ext4 formatting
 and readback for retained dpkg metadata, sudo modes, template configuration,
-staging failures, and checksum provenance. It does not run debootstrap or boot a VM.
+staging failures, durable build diagnostics, and checksum provenance. The apt
+shell script runs against stub mount/chroot commands to check argument handling
+and stop-on-error behavior. Tests simulate Ubuntu removing `policy-rc.d` after
+bootstrap. They do not run debootstrap or boot a VM.
 Lifecycle resize tests use fake processes/networking to verify ordering,
 single-lock ownership, identity preservation, pending intent, and failure recovery.