Bootstrap CA certs before HTTPS apt in CICD base image

Dockerfile.cicd-base

@@ -19,28 +19,41 @@ ENV TZ=America/New_York
 # Configure timezone
 RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
 
-# Force apt repositories onto HTTPS so runner network policy does not depend on plain HTTP access.
-RUN set -eux; \
-    find /etc/apt -type f \( -name 'sources.list' -o -name '*.sources' -o -name '*.list' \) -print0 \
-      | xargs -0 sed -i 's|http://ports.ubuntu.com/ubuntu-ports|https://ports.ubuntu.com/ubuntu-ports|g; s|http://archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g; s|http://security.ubuntu.com/ubuntu|https://security.ubuntu.com/ubuntu|g'
-
 # Configure apt timeouts and retries
 RUN echo 'Acquire::Retries "3";' > /etc/apt/apt.conf.d/80retries && \
     echo 'Acquire::http::Timeout "60";' >> /etc/apt/apt.conf.d/80retries && \
     echo 'Acquire::https::Timeout "60";' >> /etc/apt/apt.conf.d/80retries && \
     echo 'Acquire::ftp::Timeout "60";' >> /etc/apt/apt.conf.d/80retries
 
-# Install system dependencies using plain apt-get for runner compatibility.
+# Bootstrap certificates over HTTP, then enforce HTTPS for all remaining package operations.
 RUN set -eux; \
     apt-get clean; \
     rm -rf /var/lib/apt/lists/*; \
+    find /etc/apt -type f \( -name 'sources.list' -o -name '*.sources' -o -name '*.list' \) -print0 \
+      | xargs -0 sed -i 's|https://ports.ubuntu.com/ubuntu-ports|http://ports.ubuntu.com/ubuntu-ports|g; s|https://archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g; s|https://security.ubuntu.com/ubuntu|http://security.ubuntu.com/ubuntu|g'; \
     for i in 1 2 3; do \
-        echo "Attempt $i: Updating package lists..."; \
+        echo "Attempt $i: Bootstrapping CA certificates..."; \
+        if apt-get update && apt-get install -y --no-install-recommends ca-certificates; then \
+            break; \
+        fi; \
+        if [ "$i" -lt 3 ]; then \
+            echo "Bootstrap attempt $i failed, retrying..."; \
+            sleep 10; \
+        else \
+            exit 1; \
+        fi; \
+    done; \
+    update-ca-certificates; \
+    find /etc/apt -type f \( -name 'sources.list' -o -name '*.sources' -o -name '*.list' \) -print0 \
+      | xargs -0 sed -i 's|http://ports.ubuntu.com/ubuntu-ports|https://ports.ubuntu.com/ubuntu-ports|g; s|http://archive.ubuntu.com/ubuntu|https://archive.ubuntu.com/ubuntu|g; s|http://security.ubuntu.com/ubuntu|https://security.ubuntu.com/ubuntu|g'; \
+    rm -rf /var/lib/apt/lists/*; \
+    for i in 1 2 3; do \
+        echo "Attempt $i: Updating package lists over HTTPS..."; \
         if apt-get update; then \
             break; \
         fi; \
         if [ "$i" -lt 3 ]; then \
-            echo "Update attempt $i failed, retrying..."; \
+            echo "HTTPS update attempt $i failed, retrying..."; \
             sleep 10; \
         else \
             exit 1; \