fix: install cnb pack from github releases instead of ppa

The ppa:cncf-buildpacks/pack-cli launchpad source is currently down, breaking the runtime image build and any bats run that calls install_pack. Pack is now tracked in contrib/dependencies.json and pulled from the buildpacks/pack GitHub release tarball, matching how other binary deps are managed. update-deb-dependencies gains hyphen-aware word-boundary matching so single-word names like pack cannot accidentally rewrite unrelated debian/control lines, keeping pack out of the package's hard requirements.

contrib/dependencies.json

@@ -32,6 +32,14 @@
         "arm64": "https://github.com/dokku/netrc/releases/download/v0.11.0/netrc-linux-arm64"
       }
     },
+    {
+      "name": "pack",
+      "version": "0.40.3",
+      "urls": {
+        "amd64": "https://github.com/buildpacks/pack/releases/download/v0.40.3/pack-v0.40.3-linux.tgz",
+        "arm64": "https://github.com/buildpacks/pack/releases/download/v0.40.3/pack-v0.40.3-linux-arm64.tgz"
+      }
+    },
     {
       "name": "procfile-util",
       "version": "0.20.7",

contrib/update-deb-dependencies

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 import json
+import re
 
 
 def main():
@@ -18,11 +19,9 @@ def main():
         for dependency in deps[key]:
             name = dependency["name"]
             version = dependency["version"]
+            pattern = re.compile(rf"(?<![\w-]){re.escape(name)}(?![\w-])")
             for i, line in enumerate(control_lines):
-                if name in line:
-                    control_lines[i] = control_lines[i].replace(
-                        name, f"{name} (>= {version})"
-                    )
+                control_lines[i] = pattern.sub(f"{name} (>= {version})", line)
 
     with open("debian/control", mode="w", encoding="utf-8") as handle:
         handle.writelines(control_lines)