RV-S8: Offline bundle download suppresses failures with || true #182

What happened

External repo review at commit c7bebd1 reproduced: scripts/offline/build_bundle.sh L37–49 suppresses all apt-get download failures with || true; the following check verifies only four top-level packages. A stubbed failed dependency download still produced success with that dependency absent.

Why this matters

Sub-issue of #60. The clean-VM dry run (due 15 Nov) depends on the bundle containing every dependency it claims. The current script cannot be trusted to produce a complete bundle, so an evidence run against the current script would not actually prove the install works offline — it would only prove the install works when the missing deps happen not to be exercised.

Proposed

1. Remove || true from the apt-get download loop.
2. After download, verify the complete dependency closure (every package the smoke test's install.sh invokes must be present).
3. Fail the script loudly on any missing package.
4. Rebuild the bundle on a current main after fix; new SHA-256 replaces the one on 2026-11-15: ship air-gapped install procedure or keep interim wording #60.

Done when

• Stubbed missing dependency causes build_bundle.sh to fail.
• Clean-build on main produces a bundle whose dependency closure matches install.sh's needs.
• New bundle SHA-256 attached to 2026-11-15: ship air-gapped install procedure or keep interim wording #60 (replaces the 2f10940 bundle).

Reference

Tracker row G41. Repo review finding RV-S8. Blocks #60 clean-VM dry run evidence acceptance.