fix(images): refresh the opkg index in the layer that installs

[VizzleTF]

opkg_install_pkg: Checksum or size mismatch for package bash
target owrt2410: failed to solve: … opkg install --force-overwrite … exit code: 255
owlab: build failed: exit status 1

Why

opkg update ran in an earlier RUN than the install of the staged
extra_packages files. Buildkit keeps that layer for as long as the release and the
feed package list hold, while the install layer re-runs on every change to the staged
files. The two are routinely months apart.

A pinned point release does not make that safe. OpenWrt rebuilds the packages inside
releases/24.10.8/ in place, without bumping a version, so an index from an older
build names bytes the server no longer serves:

docker run --rm --entrypoint /bin/cat <image built 2026-07-29> \
  /var/opkg-lists/openwrt_packages | gunzip
    ->  bash 5.2.37-r1  Size 473650  SHA256 f1872e60...

curl -s .../24.10.8/packages/aarch64_generic/packages/Packages.gz | gunzip
    ->  bash 5.2.37-r1  Size 473647  SHA256 20eaa220...   (Last-Modified: 03 Sep 2026)

opkg install bash in that image reproduces the message verbatim. It bites at the
staged-package step rather than the feed step because a local package is installed by
path, but its dependencies still come out of the index.

Excluded by measurement: the pin has not expired (owlab releases reports all eight
routers up to date), the feed has not moved (distfeeds.conf points at 24.10.8, HTTP
200), and it is not about bash — the whole index was rebuilt on 2026-09-03.

What changes

opkg update now runs in the layer that installs, inside the if, so a build with no
out-of-feed package still fetches nothing. owlab test sets Update: true
unconditionally for the same reason: a router boots with whatever index its cached
image layer left behind.

The apk line needs nothing, also measured

apk-tools 3.0.5 revalidates a cached index older than --cache-max-age (four hours by
default) on its own: an apk add inside a month-old image re-downloaded every APKINDEX
(744322 -> 733065 bytes) before resolving, and a second one seconds later did not. opkg
has no such policy — it reads whatever the last opkg update left and never asks.

Cost

Nothing stops caching. A repeat owlab up with no changes is 28 CACHED, 1.6 s, zero
downloads. Changing only an extra package leaves layer 2/12 CACHED and takes 4/12 from
3.8 s to 4.6 s — about 1.6 s and 1 MB of gzipped indexes per opkg router. The apk layer
is untouched.

Verified

Both release lines build; LuCI answers 200 on all routers and the theme is in place.
owlab test passes 2 of 2 on 24.10.8 and 25.12.4. dash -n clean on every script and
on the changed RUN body; gofmt/go vet clean; go test ./... clean apart from the
pre-existing TestMissingQEMUSaysWhereItLookedAndWhatToRun, which fails on any machine
with qemu installed.

Troubleshooting entries added in both languages.