Summary

apt install --update ... is roughly equivalent to running apt update && apt install ... on newer apt versions. I think this is almost never what we want, at least in CI:

1. It's slow, since updating forces apt to refresh all index listings (including third party listings that happen to be enabled on the runner, like the Google Chrome listing).
2. It's a source of unreliability/flakes, since listings frequently either 404 or are not updated atomically, meaning apt fails with consistency errors. Example: https://github.com/astral-sh/uv/actions/runs/26763578883/job/78883783836?pr=18927

Note: I haven't changed this in any Dockerfiles, since I don't think --update is as much of a reliability risk there.

NB: There's one place where I think we want it, i.e. when we do dpkg --add-architecture since dpkg won't update the lists for us.

Test Plan

NFC. CI only.