fix: improve build reliability with fallback apt mirrors (#18155)

## Summary
- Fixes image build failure by adding fallback to kernel.org mirrors
when Ubuntu/Debian repositories fail
- Ensures unzip is available during Bun installation process
- Improves apt repository configuration to prevent 403 errors in CI

## Root Cause
The build was failing for two reasons:
1. Network issues with Ubuntu/Debian package repositories returning 403
Forbidden errors
2. Unzip package not being reliably available in the image layer where
Bun installation happens

## Fix
- Added fallback mirrors for apt repositories using kernel.org mirrors
- Explicitly installed unzip before using it in the Bun installation
- Added proper cleanup after package installations to keep image size
down

## Test plan
- The CI workflow that was previously failing should now succeed
- Build the dogfood image locally with `cd dogfood/coder && docker build
-t codercom/oss-dogfood:test .`
- Verify Bun is correctly installed and can be used

Fixes build failure from PR #18154 (original PR that added Bun)

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude <noreply@anthropic.com>

dogfood/coder/Dockerfile

@@ -2,8 +2,10 @@
 FROM rust:slim@sha256:3f391b0678a6e0c88fd26f13e399c9c515ac47354e3cadfee7daee3b21651a4f AS rust-utils
 # Install rust helper programs
 ENV CARGO_INSTALL_ROOT=/tmp/
-RUN apt-get update
-RUN apt-get install -y libssl-dev openssl pkg-config build-essential
+# Use more reliable mirrors for Debian packages
+RUN sed -i 's|http://deb.debian.org/debian|http://mirrors.edge.kernel.org/debian|g' /etc/apt/sources.list && \
+    apt-get update || true
+RUN apt-get update && apt-get install -y libssl-dev openssl pkg-config build-essential
 RUN cargo install jj-cli typos-cli watchexec-cli
 
 FROM ubuntu:jammy@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97 AS go
@@ -119,7 +121,10 @@ RUN mkdir -p /etc/sudoers.d && \
 	chmod 750 /etc/sudoers.d/ && \
 	chmod 640 /etc/sudoers.d/nopasswd
 
-RUN apt-get update --quiet && apt-get install --yes \
+# Use more reliable mirrors for Ubuntu packages
+RUN sed -i 's|http://archive.ubuntu.com/ubuntu/|http://mirrors.edge.kernel.org/ubuntu/|g' /etc/apt/sources.list && \
+    sed -i 's|http://security.ubuntu.com/ubuntu/|http://mirrors.edge.kernel.org/ubuntu/|g' /etc/apt/sources.list && \
+    apt-get update --quiet && apt-get install --yes \
 	ansible \
 	apt-transport-https \
 	apt-utils \
@@ -334,11 +339,15 @@ RUN curl --silent --show-error --location --output /usr/local/bin/cloud_sql_prox
 	curl --silent --show-error --location --output /usr/local/bin/cosign "https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64" && \
 	chmod a=rx /usr/local/bin/cosign && \
 	# Install Bun JavaScript runtime to /usr/local/bin
+	# Ensure unzip is installed right before using it and use multiple mirrors for reliability
+	(apt-get update || (sed -i 's|http://archive.ubuntu.com/ubuntu/|http://mirrors.edge.kernel.org/ubuntu/|g' /etc/apt/sources.list && apt-get update)) && \
+	apt-get install -y unzip && \
 	curl --silent --show-error --location --fail "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" --output /tmp/bun.zip && \
 	unzip -q /tmp/bun.zip -d /tmp && \
 	mv /tmp/bun-linux-x64/bun /usr/local/bin/ && \
 	chmod a=rx /usr/local/bin/bun && \
-	rm -rf /tmp/bun.zip /tmp/bun-linux-x64
+	rm -rf /tmp/bun.zip /tmp/bun-linux-x64 && \
+	apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # We use yq during "make deploy" to manually substitute out fields in
 # our helm values.yaml file. See https://github.com/helm/helm/issues/3141