fix: canonicalize repository apk executable

[tifycloud]

Summary

• canonicalize the selected host apk executable before repository staging changes the subprocess working directory
• preserve normal PATH lookup for bare executable names
• fail closed for missing, non-regular, or non-executable paths
• add regression coverage for the GitHub Actions relative-path failure, PATH shadowing, and executable permissions

Root cause

Run 29890375886 successfully built OpenWrt host tools, the target toolchain, and the locked APK set, then passed a workspace-relative executable path to stage-package-repository.py. The script changed cwd to the repository staging directory before invoking apk mkndx, so the relative executable path was resolved from the wrong directory and raised FileNotFoundError.

Verification

• python3 tests/test_package_repository.py -v (13 tests)
• bash tests/test_package_repository_policy.sh
• bash tests/test_static.sh
• actionlint -color=false .github/workflows/*.yml
• shellcheck -S warning scripts/*.sh tests/*.sh
• python3 -m py_compile scripts/stage-package-repository.py tests/test_package_repository.py
• git diff --check
• independent reviewer verdict: APPROVE