Harden web-shell prereq install against transient apt failures

The apt-get update/install calls had no error handling, so dpkg-lock
contention with other startup scripts or a flaky network left dtach
silently uninstalled and web-shell broke on first session. Retry up to
3 times with backoff, and verify dtach is on PATH before launching
web-shell so failures surface immediately.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chapterjason

terraform/web-shell/run.sh

@@ -31,8 +31,31 @@ for pkg in dtach build-essential python3; do
 done
 if [ $${#need[@]} -gt 0 ]; then
   printf "$${BOLD}Installing prereqs: $${need[*]}$${RESET}\n"
-  sudo apt-get update
-  sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$${need[@]}"
+  # Retry on transient apt failures: dpkg-lock contention when other startup
+  # scripts run apt in parallel, network flakes on apt-get update, mirror
+  # hiccups. Exit codes were previously unchecked, so failures silently left
+  # dtach missing and web-shell broke on first session.
+  installed=0
+  for attempt in 1 2 3; do
+    if sudo apt-get update && \
+       sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$${need[@]}"; then
+      installed=1
+      break
+    fi
+    echo "apt-get attempt $${attempt} failed; retrying..." >&2
+    sleep $$((attempt * 2))
+  done
+  if [ "$${installed}" -ne 1 ]; then
+    echo "Failed to install prereqs after 3 attempts: $${need[*]}" >&2
+    exit 1
+  fi
+fi
+
+# dtach is load-bearing — web-shell's session survival across disconnects
+# depends on it. Fail loud rather than starting web-shell without it.
+if ! command -v dtach >/dev/null 2>&1; then
+  echo "dtach missing after install step; aborting." >&2
+  exit 1
 fi
 
 # Install or upgrade web-shell if the installed version doesn't match.