perf(host-init): skip APT refresh when baseline packages are installed

host-init.sh

@@ -3,6 +3,20 @@
 set -euo pipefail
 export LC_ALL=C
 fail() { printf 'ERROR: %s\n' "$*" >&2; return 1; }
+ensure_baseline_packages() {
+  local package missing=()
+  for package in ca-certificates curl jq git openssl openssh-client iproute2; do
+    if [[ $(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null) != installed ]]; then
+      missing+=("$package")
+    fi
+  done
+  if ((${#missing[@]})); then
+    apt-get -o DPkg::Lock::Timeout=60 update
+    apt-get -o DPkg::Lock::Timeout=60 install -y --no-install-recommends "${missing[@]}"
+  else
+    echo 'Baseline packages already installed; APT refresh skipped.'
+  fi
+}
 check_existing_binding() {
   local state_dir=$1 expected=$2 bound=''
   local binding="$state_dir/binding"
@@ -59,8 +73,7 @@ main() {
   umask 077
   exec 9>>/run/lock/platform-host-init.lock; flock -n 9 || { fail 'Host initialization is already running'; return 1; }
   check_existing_binding /var/lib/platform-bootstrap "$name"
-  apt-get -o DPkg::Lock::Timeout=60 update
-  apt-get -o DPkg::Lock::Timeout=60 install -y --no-install-recommends ca-certificates curl jq git openssl openssh-client iproute2
+  ensure_baseline_packages
   if ((${#debs[@]})); then apt-get -o DPkg::Lock::Timeout=60 install -y "${debs[@]}"; fi
   hostnamectl set-hostname "$name"
   if [[ -n "$public_key" ]]; then