Stopped apt-get update being the gate it was never meant to be (#7)

A release build went red because Google's Chrome apt repository served a
Packages.gz that did not match its own Release file -- their CDN caught
mid-publish, the index eight hours older than the manifest describing it.
apt-get update fails if ANY configured repository serves a bad index, so
install.sh failed three attempts running, and nothing was built.

Verified as theirs rather than ours, from a second machine: the Release file
asks for 233e56de and the Packages.gz they serve hashes to bc1428ab, which are
the two hashes in the failing log. Not a runner glitch and not a network blip;
retrying gets the same answer until they republish.

Nothing in this project installs a browser. The runner image happens to carry
that repository and Microsoft's, and one of them being broken is now enough to
stop a build that needs neither.

SO THE UPDATE WARNS AND THE INSTALL IS THE GATE. Nothing is weakened by that.
apt-get install still fails hard on a package it cannot find, so an archive
that is genuinely unreachable still stops the script -- one step later, and
naming the package it could not get, which is a better diagnostic than a hash
mismatch in a repository nobody asked for.

THE OBVIOUS ALTERNATIVE IS WORSE AND IS NOT TAKEN. Disabling third-party
sources before updating would make the update strict again, and this script
also runs on a contributor's own machine, where silently rewriting their apt
configuration to suit our CI would be a considerably worse thing to do than
tolerating a stale index for a repository we do not read.

Verified in both directions: a failing update warns and execution continues
past it, and a genuine command failure still aborts under set -e.

Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com>

Author: fdesbiens

scripts/install.sh

@@ -64,7 +64,31 @@ retry() {
     return 1
 }
 
-retry sudo "${TIMEOUT[@]}" apt-get "${APT_OPTIONS[@]}" update
+# THE UPDATE IS NOT THE GATE, AND IT MUST NOT BE.  apt-get update fails if ANY
+# configured repository serves a bad index, including ones this project does
+# not use.  On a GitHub runner the image carries Google's and Microsoft's
+# repositories, and a Hash Sum mismatch from Google's -- their CDN caught
+# mid-publish, index and Release file eight hours apart -- failed this script
+# three attempts running and turned a release build red over a browser nobody
+# was installing.
+#
+# The alternative of disabling third-party sources before updating is wrong
+# here: this script also runs on a contributor's own machine, where silently
+# rewriting their apt configuration would be a far worse thing to do than
+# tolerating a stale index.
+#
+# So a failed update WARNS and the install below is the gate.  Nothing is
+# weakened by that: apt-get install still fails hard on a package it cannot
+# find, so an archive that is genuinely unreachable still stops the script --
+# one step later, and saying which package it could not get.
+if ! retry sudo "${TIMEOUT[@]}" apt-get "${APT_OPTIONS[@]}" update; then
+    echo ""
+    echo "install.sh: apt-get update did not fully succeed."
+    echo "install.sh: continuing, because a repository this project does not"
+    echo "install.sh: use can fail an update.  The install below is the real"
+    echo "install.sh: gate and fails if any package needed is unavailable."
+    echo ""
+fi
 # gcc-14 and g++-14 EXPLICITLY, alongside build-essential.
 #
 # build-essential on ubuntu-24.04 is GCC 13, and GCC 14 is the compiler the