fix(orchestrator): harden provision.sh with chattr fallback and APT time fix

[tomassrnka]

Cherrypicked fix from #1875 as separate PR

[tomassrnka]

bugbot run

[cursor]

PR Summary

Medium Risk
Medium risk because it changes base image provisioning behavior and disables APT date checks, which could mask repo metadata freshness issues if mirrors are misconfigured or compromised.

Overview
Makes provision.sh resilient when chattr isn’t available by detecting support before setting/unsetting immutability on /etc/resolv.conf, and adjusts APT commands to disable date/valid-until checks so package install/update can succeed when Firecracker VMs boot with an epoch clock.

^{Written by Cursor Bugbot for commit 720ceee. This will update automatically on new commits. Configure here.}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

[arkamar]

Is this fallback really necessary? What I mean is that busybox should be always available, right? Therefore if $BUSYBOX chattr +i fail the chattr +i will fail as well. Or am I missing something?