Yes, I know how to use SSH and do apt-get, but the most likely outcome is that the installation will still fail: after all, the Application Manager uses the same apt-get, as I understand things.

I suggest that rather than writing more custom installation tools, you try to reduce the amount of stuff Canola depends on, especially stuff that is not on the tablet by default. The more external packages you rely upon, the more installation problems your users will get.