An unattended package timer fails and manual apt update works

Interactive updates inherit the shell CA bundle hint, yet the timer environment never sees it and rejects the HTTPS mirror chain.