ci: hold irrelevant hardware/firmware packages out of VM upgrade

[mdbig1]

Summary

• Provision VM step intermittently times out — apt upgrade downloads ~700MB+ of linux-firmware-* and other physical-hardware-only packages (snapd, fwupd, console-setup, disk/wireless tooling) irrelevant on a KVM cloud VM, eating most of the 10min per-attempt budget before runner registration runs
• Hold these packages out of the upgrade in .github/apply-ubuntu-upgrades.sh

DO-2588

Test plan

• Confirm Provision VM step completes well under timeout on next CI run
• Confirm build-creditcoin-node job still succeeds (docker/runner install unaffected)

[cursor]

PR Summary

Low Risk
CI-only provisioning script change; skips non-essential package upgrades on throwaway VMs with no production runtime impact.

Overview
Provision VM was timing out because apt-get upgrade pulled hundreds of MB of firmware and physical-hardware packages that do not matter on Linode KVM CI VMs.

.github/apply-ubuntu-upgrades.sh now apt-mark holds linux-firmware*, snapd, fwupd, packagekit, console/disk/wireless utilities, and related packages—same pattern as the existing grub holds—so upgrades stay smaller and finish within the provisioning window without changing Docker/runner install steps.

^{Reviewed by Cursor Bugbot for commit 619f9f3. Bugbot is set up for automated code reviews on this repo. Configure here.}