Bootstrap prerequisites

On a minimal Debian host, establish basic network access and package metadata before first bootstrap when necessary:

sudo apt update && sudo apt install -y \
  sudo ca-certificates gnupg curl wget \
  net-tools iproute2 openssh-server chrony \
  ufw unattended-upgrades fail2ban auditd

Then use the bootstrap runner. This manual list is an operational aid, not a replacement for the managed package policy.