[fix] Refresh the factory lock for available ARM packages

[Fail-Safe]

Factory builds stop before package installation because the current ARM repository transaction differs from the checked-in lock. Refresh the lock to the available signed package versions: FUSE, GTK, ORC, and the matching kernel/header pair, plus the newly resolved numactl dependency.

The reviewed Hyprland, Aquamarine, Hyprtoolkit, and Mesa versions remain unchanged. This changes the factory-image transaction only; it does not update existing VM disks. No prepopulated package cache or cache-only pins are required.

Validation:

• Full test suite on this main-based branch: 103 guest tests, 242 native tests, and shell/storage checks passed.
• Resolved from fresh repository databases, then built the factory with a brand-new empty package/source cache. Package integrity checks and final filesystem verification passed.
• Full source-built QEMU runtime, app packaging, signatures, and macOS 15 compatibility checks passed on the integration review branch using this exact lock, package list, build spec, and ABI pins.
• That app booted a fresh factory VM and received its healthy integration report before manual setup. This runtime validation included the separately proposed guest integrations; it was not a build of this lock-only branch.

Rolling repositories can change again; this restores a clean build against the versions available during validation rather than providing a permanent package archive.