i was exploring why we are running update many places in the codebase
and noticed we used apt-get in the start but it doesnt seem required, so
proposing to stream line the commands with just one
This is a follow-up to 1767107038 -
instead of checking out `FETCH_HEAD`, which always puts the user in
'detached HEAD' state, we will check out `${OMAKUB_REF:-stable}` so that
we only end up in 'detached HEAD' state when necessary (i.e. when
checking out a SHA rather than a branch).
