fix: find build tools in /usr/sbin regardless of PATH

check-host-deps (and the build scripts themselves) reported build
dependencies as missing even though the packages were installed. Several
tools — debootstrap, sgdisk, losetup, partprobe, mkfs.vfat, grub-install —
live in /usr/sbin or /sbin, which non-root users and CI runners often
don't have on PATH, so `command -v` failed.

- common.sh now prepends /usr/local/sbin:/usr/sbin:/sbin to PATH, so every
  script finds these tools no matter who invokes the build.
- check-host-deps now distinguishes "package not installed" from "installed
  but not on PATH" via dpkg-query, so the message tells you exactly what is
  wrong instead of a misleading "missing package".

scripts/check-host-deps.sh

@@ -37,9 +37,16 @@ MISSING=()
 for entry in "${NEEDED[@]}"; do
   bin="${entry%%|*}"; pkg="${entry##*|}"
   if ! command -v "$bin" >/dev/null 2>&1; then
+    # Distinguish "package not installed" from "installed but not on PATH".
+    if command -v dpkg-query >/dev/null 2>&1 && \
+         dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q "install ok installed"; then
+      warn "missing: $bin — package $pkg IS installed but '$bin' is not on PATH (check for /usr/sbin or /sbin in PATH)"
+      MISSING+=("$pkg")   # still require a working resolution before building
+    else
       MISSING+=("$pkg")
       warn "missing: $bin (package: $pkg)"
     fi
+  fi
 done
 
 if [[ ${#MISSING[@]} -eq 0 ]]; then

scripts/common.sh

@@ -39,6 +39,18 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # Valid edition names, mirroring versions.mk.
 EDITIONS=(server workstation cloud)
 
+# ── tool resolution ─────────────────────────────────────────────────────────
+# Many build tools (debootstrap, sgdisk, losetup, partprobe, mkfs.vfat,
+# grub-install, update-grub) live in /usr/sbin or /sbin. Non-root users and
+# service accounts (CI runners, systemd timers) often omit those from PATH,
+# which makes `command -v` report them as missing even though the packages are
+# installed — and makes direct invocations fail. Prepend the sbin dirs so
+# every script finds them regardless of who runs the build.
+case ":$PATH:" in
+  *":/usr/local/sbin:"*|*":/usr/sbin:"*|*":/sbin:"*) ;;
+  *) export PATH="/usr/local/sbin:/usr/sbin:/sbin:$PATH" ;;
+esac
+
 # ── output helpers ──────────────────────────────────────────────────────────
 log()  { printf '\033[1;34m[arcline]\033[0m %s\n' "$*"; }
 warn() { printf '\033[1;33m[arcline]\033[0m warning: %s\n' "$*" >&2; }