fix: find build tools in /usr/sbin regardless of PATH

check-host-deps (and the build scripts themselves) reported build
dependencies as missing even though the packages were installed. Several
tools — debootstrap, sgdisk, losetup, partprobe, mkfs.vfat, grub-install —
live in /usr/sbin or /sbin, which non-root users and CI runners often
don't have on PATH, so `command -v` failed.

- common.sh now prepends /usr/local/sbin:/usr/sbin:/sbin to PATH, so every
  script finds these tools no matter who invokes the build.
- check-host-deps now distinguishes "package not installed" from "installed
  but not on PATH" via dpkg-query, so the message tells you exactly what is
  wrong instead of a misleading "missing package".

scripts/common.sh

@@ -39,6 +39,18 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # Valid edition names, mirroring versions.mk.
 EDITIONS=(server workstation cloud)
 
+# ── tool resolution ─────────────────────────────────────────────────────────
+# Many build tools (debootstrap, sgdisk, losetup, partprobe, mkfs.vfat,
+# grub-install, update-grub) live in /usr/sbin or /sbin. Non-root users and
+# service accounts (CI runners, systemd timers) often omit those from PATH,
+# which makes `command -v` report them as missing even though the packages are
+# installed — and makes direct invocations fail. Prepend the sbin dirs so
+# every script finds them regardless of who runs the build.
+case ":$PATH:" in
+  *":/usr/local/sbin:"*|*":/usr/sbin:"*|*":/sbin:"*) ;;
+  *) export PATH="/usr/local/sbin:/usr/sbin:/sbin:$PATH" ;;
+esac
+
 # ── output helpers ──────────────────────────────────────────────────────────
 log()  { printf '\033[1;34m[arcline]\033[0m %s\n' "$*"; }
 warn() { printf '\033[1;33m[arcline]\033[0m warning: %s\n' "$*" >&2; }