Fix read failures in install scripts and recovery menu

Two critical bugs fixed:

1. Install scripts (80+) using 'read' for interactive prompts all fail because
   lxc-attach stdin was redirected from /dev/null. Change to /dev/tty so install
   scripts like immich, elementsynapse, etc. can prompt the user interactively.

2. Recovery menu read gets 'Input/output error' from /dev/tty after the
   lxc-attach|tee pipeline corrupts the terminal state. Pre-open a separate
   file descriptor to /dev/tty BEFORE the pipeline starts. This fd survives
   any tty corruption and is used as fallback for the recovery menu read.
   Fixes the 'command not found' issue where user input falls through to the
   parent shell.

Both build.func (main install + APT retry) and error_handler.func (fallback
cleanup prompt) are updated with the same pattern.

misc/error_handler.func

@@ -286,7 +286,15 @@ error_handler() {
         echo -en "${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
       fi
 
-      if read -t 60 -r response </dev/tty; then
+      # Use the pre-opened tty fd if available (survives tty corruption from lxc-attach|tee)
+      stty sane 2>/dev/null || true
+      local _read_fd="${_RECOVERY_TTY:-}"
+      local _read_src="</dev/tty"
+      if [[ -n "$_read_fd" ]] && { true <&"$_read_fd"; } 2>/dev/null; then
+        _read_src="<&$_read_fd"
+      fi
+
+      if eval "read -t 60 -r response $_read_src"; then
         if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
           echo ""
           if declare -f msg_info >/dev/null 2>&1; then