Well with this script I seem to be able to apt install at least some packages without modifying the phone system:
sudo ./test.sh
[sudo] password for phablet:
root@ubuntu-phablet:/# apt install htop
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Suggested packages:
lm-sensors
The following NEW packages will be installed:
htop
0 upgraded, 1 newly installed, 0 to remove and 63 not upgraded.
Need to get 171 kB of archives.
After this operation, 455 kB of additional disk space will be used.
Get:1 http://ports.ubuntu.com/ubuntu-ports noble/main arm64 htop arm64 3.3.0-4build1 [171 kB]
Fetched 171 kB in 0s (421 kB/s)
dpkg-preconfigure: unable to re-open stdin: No such file or directory
E: Can not write log (Is /dev/pts mounted?) - posix_openpt (2: No such file or directory)
Selecting previously unselected package htop.
(Reading database ... 60848 files and directories currently installed.)
Preparing to unpack .../htop_3.3.0-4build1_arm64.deb ...
Unpacking htop (3.3.0-4build1) ...
Setting up htop (3.3.0-4build1) ...
Processing triggers for hicolor-icon-theme (0.17-2) ...
W: No sandbox user '_apt' on the system, can not drop privileges
root@ubuntu-phablet:/# htop --version
htop 3.3.0
root@ubuntu-phablet:/# exit
exit
phablet@ubuntu-phablet:~$ htop
-bash: htop: command not found
test.sh (WARNING this is very experimental use at your OWN RISKS, I DO NOT TAKE ANY RESPONSABILITY in case of a problem)
#!/bin/sh
set -e
mkdir -p /tmp/upper /tmp/work /tmp/merged /tmp/merged/.old
exec unshare -m --propagation private /bin/sh -c '
mkdir -p /tmp/upper /tmp/work /tmp/merged /tmp/merged/.old
mount -t overlay overlay \
-o lowerdir=/,upperdir=/tmp/upper,workdir=/tmp/work \
/tmp/merged
mkdir -p /tmp/merged/.old
mkdir -p /tmp/upper/etc/
cp /etc/resolv.conf /tmp/upper/etc/
pivot_root /tmp/merged /tmp/merged/.old
mkdir -p /usr/share/man
mkdir -p /usr/share/doc
mkdir -p /usr/share/lintian
mount -t tmpfs tmpfs /usr/share/man
mount -t tmpfs tmpfs /usr/share/lintian
mount -t tmpfs tmpfs /usr/share/doc
mount -t proc proc /proc || true
mount -t sysfs sysfs /sys || true
mount -t tmpfs tmpfs /dev || true
cd /
exec bash
'
It might not be ideal, and will probably not work with any package at all, but this is already quite an achievement to be able to do that.