fix(control-plane): tolerate non-EC2 apt sources

[brandonhresko]

Summary

• keep bootstrap running when non-EC2 hosts have no EC2 apt mirror
• preserve the EC2 reachability fallback for AWS images
• add regression coverage for the safe no-match path

Testing

• npm run typecheck
• npm run lint:gate
• control-plane: 448 passed, 37 skipped
• control-plane Python conformance: 1 passed
• control-plane scripts: 15 passed
• webapp: 244 passed

Root npm test still exits non-zero on macOS because two untouched blitz-term-credentials tests expand an empty array under the system Bash 3.2 with set -u.