After reinstalling Android from stock images, why do updates complain about modified /system files?

After discovering the hard way that rooting modifying /system looking at /system the wrong way breaks updates, I've decided to drop all of the power-user stuff and just go the sanctioned route—no custom recovery system or rooting or anything; just pure, stock Android. To that end, I set about performing a factory reset [unrooting], so to speak.

These are the steps I've followed:

1. Acquire the platform-tools for your computer's operating system. Extract them and add the resulting directory to your $PATH.


2. Download a stock-Android image, making sure that the model identifier matches that of your device, but that the version is not the latest (this is necessary for step 8). Verify the image using the hash included in the table, then extract it. Fire up a shell if you haven't already, and change to the extracted directory.


3. Unlock the bootloader (fastboot oem unlock).


4. Reinstall Android (./flash-all.sh). Be sure to catch the device before the last reboot by holding down the boot-to-recovery key combination as soon as the script prints rebooting... after writing the cache image (this saves you having to reboot again for the next step).


5. Lock the bootloader (fastboot oem lock).


6. Reboot. Wait for Android to…do whatever it does when you boot a new version for the first time.


7. Go through the initial device setup. (I personally connect to a Wi-Fi network, and then skip everything else to save a bit more time).


8. Check for, download, and install an Android OS update. Wait some more while that happens.


9. Observe the following on the device's screen, with the text Error! in white beneath it:

10. Bring up the recovery menu and choose View recovery logs, then /cache/recovery/last_log. Scroll to the bottom and look for an indication of why the update failed. Transcribe the most relevant lines, along with the version and build ID of the image from step 2.

My device is a Nexus 5, purchased in November of 2013 from the Play Store. So far, I've tried this using Android 6.0.0/MRA58K and Android 5.1.1/LMY48M, which produced the following in the recovery logs:

6.0.0/MRA58K:

failed to stat "/cache/saved.file": No such file or directory

script aborted: "/system/priv-app/SetupWizard/oat/arm/SetupWizard.odex" has unexpected contents.

5.1.1/LMY48M:

Remounting and verifying system partition files...

script aborted: assert failed: sha1_check(read_file("/system/fonts/NotoSansTC-Regular.otf"), some_hash)

In both cases, the problem seems to be a file under /system with contents that aren't equal to the ones the update installer is expecting. This is exceptionally frustrating, given that my procedure specifically calls for official stock-Android images, retrieved from none other than Google's website and verified using the hashes they publish (and yes, I make sure to use TLS).

Did I miss a step? What's going wrong here? And how do I get back onto the blessed path and be once again deemed worthy to receive the long-sought-after over-the-air updates?