move unattended-upgrades into core utils, and make sure it is actually on

apt only. It is a Debian and Ubuntu package — dnf's equivalent is dnf-automatic
and pacman has no equivalent at all — so it is not a name to translate across the
other lists.

Installing the package is not by itself enough to switch it on. The apt-daily
timers read /etc/apt/apt.conf.d/20auto-upgrades, and on this host no package owns
that file: `dpkg -S` says it came from nothing, which means the original script
wrote it. So the section checks for it and offers to write it, rather than
assuming the install did.

Beyond that it only reports, because the interesting facts about unattended
upgrades are not whether it installed:

  It never reboots on its own, deliberately. A kernel or libc update is installed
  and then not used, and the machine keeps running the old one until it restarts.
  Nothing announces that except /var/run/reboot-required, which nobody reads. The
  section prints it, names the packages waiting, and puts it in the summary — it
  is the failure people do not notice for months.

  Ubuntu's Allowed-Origins includes plain ${distro_codename} as well as
  -security, so this takes ordinary updates too, not only security ones.

Verified both paths: this host reports enabled with no reboot pending, and
pointing AUTO_UPGRADES at a temp file exercises the enable path and writes the
three periodic settings.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/packages.sh

@@ -51,7 +51,14 @@ LAST_SKIPPED=()
 # are the environment: nothing calls them, they are here because a box you use
 # should have them.
 #
-# Two entries reach beyond simply existing on the machine.
+# Three entries reach beyond simply existing on the machine.
+#
+# unattended-upgrades installs updates on a timer with nobody watching. apt only:
+# it is a Debian and Ubuntu package, dnf's equivalent is dnf-automatic and pacman
+# has no equivalent at all, so it is not a name to translate. Installing the
+# package is not by itself enough to switch it on — /etc/apt/apt.conf.d/20auto-upgrades
+# is what the apt-daily timers read, and on this host no package owns that file.
+# The section makes sure it is there.
 #
 # fail2ban is not a tool, it is a daemon: installing it starts it, and Ubuntu
 # ships /etc/fail2ban/jail.d/defaults-debian.conf with `[sshd] enabled = true`.
@@ -76,7 +83,7 @@ pkgs_core() {
       echo curl ca-certificates gnupg git jq unzip \
         apt-transport-https lsb-release software-properties-common \
         wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools \
-        fail2ban
+        fail2ban unattended-upgrades
       ;;
     pacman)
       echo curl ca-certificates gnupg git jq unzip \