fix: surface avahi .deb install failures, and skip eth0 smoke check without a cable

[ArnavVWadhwa]

The published image booted running stock avahi on 5353, not the patched 5358 build, even though the build was green and CI passed. Two bugs hid it.

The build swallowed the failure. customize.sh runs as bash customize.sh (from both build-image.sh and this workflow), so its #!/bin/bash -e shebang is inert. On the real RPi OS Desktop base, which already ships stock avahi, the avahi-dpea .deb hits a dpkg file-overwrite conflict and never installs, but apt-get install returning nonzero did not abort the script. uv still installed, the script exited 0, and a broken image published.

CI could not reproduce it. validate.yml runs customize.sh in a bare debian:trixie container with no avahi pre-installed, so the .deb installs with no conflict and the dpkg -s avahi-dpea assertion passed. The conflict only exists against a base that already has avahi.

Changes:

• customize.sh: set -euo pipefail in the body (the shebang flags are ignored under bash customize.sh); assert dpkg -s avahi-dpea after install; ldconfig so the patched libavahi-core is what the daemon loads; hold both packages against an apt upgrade.
• validate.yml: install stock avahi-daemon + libnss-mdns before customize.sh so CI reproduces the file-overwrite conflict, and assert avahi-dpea actually owns /usr/sbin/avahi-daemon.
• hardware-smoke-test.sh: the eth0 static (172.17.21.2) only activates when the link has carrier, so a run over wifi with no cable is not a defect. SKIP instead of FAIL when eth0 has no carrier, and report a skip count.

Ordering: the actual fix that makes the .deb installable over stock lives in avahi_0.8 (add Replaces: for the stock avahi packages and build with the arm64 multiarch libdir). This PR's validate.yml gate stays red until that ships in the avahi_0.8 latest release, which is the correct signal. Do not merge before then.