GeezerVison

Every project's build ran apt-get against the live Debian archive,
making the package layer a per-project near-duplicate that worker nodes
each cached separately and adding an installation step to every cold
build. The generated Containerfile now starts from the published
triggerdotdev/node and triggerdotdev/bun images (and their -build
toolchain variants for the build stage), which ship the default packages
prebuilt: no apt runs for uncustomized projects, and the base layers are
identical across all projects by construction. User instructions and
packages apply on top in both stages, with user packages in their own
sorted install that allows downgrading pinned defaults.

apt-get install refuses to run on dpkg state an instruction left broken
(the dpkg -i pattern audioWaveform uses), so repair ahead of the user
package install whenever instructions preceded it. Customized projects
build FROM base with the toolchain installed on top so instructions run
exactly once instead of twice in independent stages, keeping external
downloads single-shot; uncustomized projects keep the prebuilt
toolchain image and zero apt. A test now pins DEFAULT_PACKAGES to the
published images' package list.

…ten repairs

Package-only projects have no instructions to run twice, so they keep
the prebuilt toolchain image and repeat only the small package install
instead of fetching the toolchain from the live archive per build. The
repair steps use --no-install-recommends like every other apt call, the
regression test asserts the composed repair-then-install RUN (the index
comparison was vacuously true when the repair was missing), and the
package-list sync test resolves paths from the test file and also pins
the toolchain list.

The publish now pushes an immutable per-publish tag, so these digests
stay tag-referenced permanently regardless of future republishes.