fix: install glab from official release .deb (wakemeops pool 404s, breaks every fresh install)

[gkastanis]

Problem

web-build/Dockerfile.canvas installs glab from the wakemeops apt repo. That repo is currently internally inconsistent: its package index lists pool/dev/g/glab/glab_1.108.0-1~ops2deb_amd64.deb, but the pool object is gone (S3 returns 404/NoSuchKey for exactly that key, while other packages in the same pool download fine). As a result apt install -y glab fails, the web-image build fails, and every fresh install of the add-on currently dies mid-install.

Reproducible outside docker:

$ curl -sI "http://deb.wakemeops.com/wakemeops/pool/dev/g/glab/glab_1.108.0-1~ops2deb_amd64.deb" | head -2
HTTP/1.1 404 Not Found
x-amz-error-code: NoSuchKey

Fix

Install the latest official release .deb from gitlab.com (gitlab-org/cli releases) instead, detecting the architecture with dpkg --print-architecture to keep the existing ARM64 support (the releases ship both linux_amd64 and linux_arm64 debs).

This also removes the third-party apt repo from the image entirely, so a future wakemeops outage can't break installs again.

Testing

Applied to a real install today (2026-07-15, linux/amd64): the web image builds, glab version reports 1.108.0 (the same version wakemeops indexed). The arm64 path is constructed identically but was not run on arm64 hardware.

Found while standing up an eval environment for the Canvas migration tooling.

🤖 Generated with Claude Code