fix: use Kaniko --snapshot-mode=redo to fix apt GPG errors in CI

Kaniko's default full-filesystem snapshots corrupt GPG verification
state, causing "invalid signature" errors during apt-get update on
Debian bookworm (node:24-slim). Using --snapshot-mode=redo avoids
this by recalculating layer diffs instead of taking full snapshots.

Also keeps the rm -rf /var/lib/apt/lists/* guard in Dockerfiles as
a defense-in-depth measure against stale base-image APT metadata.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/coordinator.yml

@@ -95,7 +95,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-coordinator:dev"
         fi
-        /kaniko/executor --context apps/coordinator --dockerfile apps/coordinator/Dockerfile $DESTINATIONS
+        /kaniko/executor --context apps/coordinator --dockerfile apps/coordinator/Dockerfile --snapshot-mode=redo $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]