`apt-get install` missing `-y` flag in generated CI workflow

## Summary

The CI workflow generated by cargo-dist runs `apt-get install` without the `-y` flag, which can cause the command to hang waiting for user confirmation in non-interactive environments.

## Details

In `cargo-dist/src/backend/ci/github.rs`, the `system_deps_install_script` function generates package install commands for CI runners. While other package managers correctly include their non-interactive flags:

- **choco**: `--yes`
- **dnf**: `--assumeyes`

`apt-get install` does not include `-y`.

### Why this hasn't been an issue on GitHub Actions

GitHub Actions standard runners pre-configure the `APT::Get::Assume-Yes` apt option, which suppresses confirmation prompts globally. This means `apt-get install` runs non-interactively even without `-y`.

### When this becomes a problem

Custom containers (`container:` in workflow) or self-hosted runners may not have `APT::Get::Assume-Yes` configured. In those environments, `apt-get install` will prompt for confirmation and hang indefinitely.

## Reproduction

Configure a cargo-dist project with system dependencies that require apt (e.g. a musl target needing `musl-tools`), and run `cargo dist plan`. The generated CI config will contain:

```
sudo apt-get update
sudo apt-get install musl-tools
```

Expected:

```
sudo apt-get update
sudo apt-get install -y musl-tools
```

## Proposed fix

Add `-y` to the `apt-get install` command in the CI generation code, consistent with how other package managers handle non-interactive mode.

Open cargo-dist/src/backend/ci/github.rs and inspect the system_deps_install_script function that generates apt-get commands. Run cargo dist plan with system dependencies such as musl-tools to reproduce the generated workflow. Done means the apt-get install command includes -y, matching the expected output and the non-interactive flags used by other package managers.

Written by the indexing model from the issue text.