feat: enhance Ubuntu rootfs build process with improved logging and error handling

USAGE.md

@@ -175,9 +175,10 @@ Installation prints the Firecracker, kernel, and rootfs paths under
 `/var/lib/uvm/integrity.json`.
 
 The default build installs `debootstrap` and `ubuntu-keyring` on the host,
-checks Ubuntu archive signatures, and builds inside private mount/PID
-namespaces. It requires native root execution with namespace support. Leave
-`UVM_ROOTFS_URL` and `UVM_ROOTFS_SHA256` unset for this mode. To use a prebuilt
+checks Ubuntu archive signatures, bootstraps the base release, then uses apt
+to apply updates and install the guest packages. It builds inside private
+mount/PID namespaces and requires native root execution with namespace support.
+Leave `UVM_ROOTFS_URL` and `UVM_ROOTFS_SHA256` unset for this mode. To use a prebuilt
 ext4 image, supply both its URL and SHA-256 instead.
 
 ### Scenario: Refresh Firecracker or Guest Assets
@@ -227,6 +228,18 @@ sudo env UVM_ALLOW_UNVERIFIED_DOWNLOADS=1 ./uvm.py start VM
 | `SHA-256 mismatch` | Stop and obtain the correct digest or artifact URL. |
 | `unsupported host architecture` | Use an x86_64 or ARM64 Linux host. |
 | `unshare: Operation not permitted` | Run the builder as root on a host permitting private mount/PID namespaces. |
+| `Ubuntu rootfs build failed` | Read `images/ubuntu-build.log` under `UVM_BASE`, fix the reported bootstrap/apt error, and rerun installation. |
+
+The latest image-build log is retained after temporary build directories are
+cleaned up, including detailed debootstrap and apt output:
+
+```sh
+sudo tail -n 100 /var/lib/uvm/images/ubuntu-build.log
+```
+
+A failed build leaves the previous rootfs template installed. If creation then
+reports missing sudo, complete the image installation successfully before
+retrying creation. The username itself does not cause that error.
 
 ## 5. Create VMs