- filter type=container (a running VM without apt/agent would hang)
- skip containers without apt-get instead of erroring
- flock against overlapping runs, csv parsing, apt-get instead of apt
- capture stderr into the log, report per-container failures and
exit non-zero so cron/monitoring can alert
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>