feat(image): auto-restart services on package upgrade (needrestart)

[passcod]

🤖 Stock Ubuntu Server restarts services after an apt upgrade — upgrade bestool and bestool-alertd.service bounces automatically. Our images don't, because that behaviour comes from needrestart (pulled in by the server task on a normal install) and these are debootstrap --variant=minbase builds installed with --no-install-recommends, which never pull it in. No needrestart means no apt post-invoke hook, so nothing restarts services running outdated code after an upgrade.

This adds needrestart to the common package list and ships a drop-in setting $nrconf{restart} = 'a' so restarts happen non-interactively (the upstream default prompts, which would hang an unattended box).

needrestart's Perl runtime modules (libproc-processtable-perl, libmodule-find-perl, libmodule-scandeps-perl, libsort-naturally-perl, libterm-readkey-perl) and xz-utils/gettext-base are hard Depends, so --no-install-recommends still installs a working needrestart.

Spec-first per repo convention: new requirement r[image.packages.service-restart], then implementation, then a structure-test check.

🤖 Generated with Claude Code