Package triggers may not run correctly via GUI installer

Observe the following. With this change:

diff --git a/system/ca-certificates/ca-certificates.trigger b/system/ca-certificates/ca-certificates.trigger
index e584113a9..01271d5d3 100644
--- a/system/ca-certificates/ca-certificates.trigger
+++ b/system/ca-certificates/ca-certificates.trigger
@@ -1,3 +1,5 @@
 #!/bin/sh
-/usr/sbin/update-ca-certificates --fresh >/dev/null 2>&1
+echo a
+/usr/sbin/update-ca-certificates --fresh >/dev/null
+echo b
 exit 0

When Horizon is launched via the GUI, the following appears in /var/log/executor.log, and it looks like everything works correctly if we hadn't made the change to the trigger:

...
(1525/1526) Installing xcursor-themes (1.0.6-r0)
(1526/1526) Installing x11 (7.7-r0)
Executing ca-certificates-20230727-r0.trigger
Executing mandoc-1.14.6-r1.trigger
Executing dbus-1.12.20-r0.trigger
Executing kmod-30-r0.trigger
Executing glib-2.72.4-r0.trigger
Executing shared-mime-info-2.2-r0.trigger
Executing fontconfig-2.13.1-r0.trigger
...

however when hscript-executor is launched directly as root, we see the expected change and confirmation that the trigger indeed runs correctly:

...
(1525/1526) Installing xcursor-themes (1.0.6-r0)
(1526/1526) Installing x11 (7.7-r0)
Executing ca-certificates-20230727-r0.trigger
a
WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping
b
Executing mandoc-1.14.6-r1.trigger
Executing dbus-1.12.20-r0.trigger
Executing kmod-30-r0.trigger
Executing glib-2.72.4-r0.trigger
Executing shared-mime-info-2.2-r0.trigger
Executing fontconfig-2.13.1-r0.trigger
...