fix: separate LXC package checks from installation

scripts/lxc/apply_updates.sh

@@ -63,6 +63,13 @@ ALLOW_HELPER_WITH_CUSTOM="${ALLOW_HELPER_WITH_CUSTOM:-0}"
 DOCKER_STANDALONE_TARGETS="${DOCKER_STANDALONE_TARGETS:-}"
 UPDATE_DOCKER_ENGINE="${UPDATE_DOCKER_ENGINE:-0}"
 
+# Reject an abandoned local-only mode rather than silently installing if an
+# older launcher still exports it. The check now has its own non-install job.
+if [[ "${CHECK_APPLY_OS:-0}" != "0" ]]; then
+  echo "ERROR: combined check-and-update was removed; run the explicit package check first." >&2
+  exit 4
+fi
+
 if [[ ! "$VMID" =~ ^[1-9][0-9]*$ ]]; then
   echo "ERROR: VMID must be a positive integer." >&2
   exit 1
@@ -123,6 +130,13 @@ if ! flock -n 9; then
   exit 7
 fi
 
+if [[ "${REQUIRE_CHECKED_OS:-0}" == "1" ]]; then
+  if ! python3 -c 'import sys; sys.path.insert(0, "/usr/local/share/proxmenux/monitor-app/usr/bin"); import lxc_check_job; lxc_check_job.checked_os(int(sys.argv[1]))' "$VMID"; then
+    echo "ERROR: a fresh successful positive OS check is required; nothing was installed." >&2
+    exit 4
+  fi
+fi
+
 STARTED_AT=$(date -Iseconds)
 NODE=$(hostname)
 echo "=== ProxMenux LXC update — CT $VMID on $NODE ==="

scripts/lxc/install_checked_os_updates.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# Install OS packages only after a valid positive check. The shared runner
+# verifies that precondition under its CT lock before any lifecycle effect.
+export REQUIRE_CHECKED_OS=1 TARGET=os RUN_HELPER=0 UPDATE_COMMAND=""
+export ALLOW_HELPER_WITH_CUSTOM=0 DOCKER_STANDALONE_TARGETS="" UPDATE_DOCKER_ENGINE=0
+exec /bin/bash "$(dirname -- "$(readlink -f -- "$0")")/apply_updates.sh"