fix: guarantee a fully updated system on bootstrap

If user just installed Qubes, the full templates can have updates
available. If user restored backups of templates and standalones, they
could also have updates available. Available updates can contain fixes
that if not applied, can make the states fail, such as a buggy salt
package and Qrexec service that can make a state fail in case the
full outdated templates and standalones are responsible for the
functionality specially of management_dispvm, updatevm, default_netvm
and qubes.UpdatesProxy service.

salt/dom0/README.md

@@ -21,12 +21,14 @@ etc.
 sudo qubesctl top.enable dom0
 sudo qubesctl state.apply
 sudo qubesctl top.disable dom0
+sudo qubesctl --skip-dom0 --templates --standalones state.apply update.qubes-vm
 ```
 
 - State:
 <!-- pkg:begin:post-install -->
 ```sh
 sudo qubesctl state.apply dom0
+sudo qubesctl --skip-dom0 --templates --standalones state.apply update.qubes-vm
 ```
 <!-- pkg:end:post-install -->