How about having the "hacker upgrade" .deb stashed somewhere secret within the 'standard' install. That way, no net connection is needed to fully enable your OS - just bury a hidden installation mechanism in the GUI, that only the brave and large-testicled hacker will hunt down....plastered with warnings and glyphs and invocations to satan etc.

Oh...and fix the damned apt bug that caused this catch-22 in the first place