feat: bootstrap apt packages on ubiworkers via --pkg

[scode]

Workers come up as a bare image; anything beyond that meant a manual
apt session on every new VM. The base set is intentionally empty for
now — nothing is needed on every worker unconditionally — so the flag
carries the per-create choice, and dist-upgrade runs regardless.

The bootstrap is detached into a transient systemd unit rather than
run inline, and launched only once tailscale enrollment has succeeded:
tailscale's installer calls apt-get with no dpkg-lock timeout, so an
apt job running first would hold the lock out from under it and could
exhaust enrollment's retry budget, leaving a billed VM unreachable. An
unreachable worker is the one outcome this must never cause; slow or
failed package installs are recoverable over ssh.

Names are installed with apt-get satisfy, not install: with
operator-supplied names, install would treat an unmatched name
containing . as a regex and a trailing - as a removal request.