fix(install): announce fallback apt-get update, make its test hermetic

[ddtcorex]

Summary

Fixes two small issues found while reviewing the CLI-only installer support merged in #103 (db0b0d7 on master):

1. desktop_install_enabled() (install.sh) silently ran sudo apt-get update when APT package lists were unpopulated, before ever explaining itself — inconsistent with every other sudo call in the script. Now logs an info() line first.
2. tests/install_script_test.go's "falls back to CLI only when unavailable" case only shimmed apt-cache, not sudo — on a machine whose real /var/lib/apt/lists happens to be empty, go test could trigger a genuine sudo apt-get update. sudo enforces its own secure_path, so a PATH-only apt-get shim would not reliably intercept it; shimming sudo itself does. Independently verified (outside the Go test, by sourcing install.sh directly with apt_lists_populated forced to fail) that the shim now correctly intercepts the call and the new info() message prints.

No behavior change to the installer's actual CLI-only-vs-Desktop decision logic — both fixes are additive (a log line, a test shim).

Validation

go build ./...
go vet ./...
gofmt -s -l .
go test ./...
make test   # lint + fmt-check + vet + unit + frontend + integration (Docker available)
bash -n install.sh

All pass. Also manually confirmed the fix end-to-end by sourcing install.sh with apt_lists_populated overridden to force the fallback branch, and a logging sudo shim in PATH — confirmed the new info() message prints and the shim (not a real sudo) is invoked.

Linked issue

Closes #105