The CI can't continue without an apt update, so fail early and properly on any error.
Can be tested with something like: podman run --rm -it --network none mirror.gcr.io/debian:unstable bash -c 'apt-get update ; echo $?'
Also, cleanup the lint install script while touching this (and allow clang-format for scripted-diffs in the rare case that they want to use it to e.g. re-sort includes)