Address coderabbitai review on PR #369:
- _run() now streams combined stdout/stderr to a temp file and returns
only the last ERROR_TAIL_LINES lines, instead of buffering full
output in memory (Codacy also flagged the previous capture_output
call as a subprocess-without-static-string security issue; the new
call is annotated as safe since cmd is built from hardcoded args).
- `apt update` now runs once in main() instead of once per package
needing an apt fallback.
5a1a095e16