There is no fallback to clearnet for default APT package sources files.
No.
Documented just now:
Disable DNS
If you read the documentation fully, you will see why it cannot be considered “the right way”.
No.
Implementing a firewall that reliably allows outgoing traffic for Linux user account debian-tor, loads early enough, has no race conditions, a fail-closed error handling mechanism and does not leak is challenging. Users won’t be able to do this.
Ticket:
Kicksecure Firewall
As said:
And you won’t be able to find a band-aid by asking in any forums either.