Thanks. I also installed about a week ago, with same
uname output, but my experience differed from yours;
deb http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi
deb http://archive.raspberrypi.org/debian/ buster main
Both files also contained commented lines. I’ve just loaded the image I used onto a USB hard drive and confirmed the second filesystem has these files to start with; they are not created on first boot, and don’t seem to be changed by first boot.
You’ve tried to repair
sources.list but the package signatures can’t be checked. That implies further loss of files, such as the keyring.
raspbian-archive-keyring is a critical piece. It installs a file
/usr/share/keyrings/raspbian-archive-keyring.gpg which has a sha256sum of 29c11309b6d3b2ec8dced7c999400055752d85b5c87a2ffcb09f84f05648c46b. You might check that.
My guess is your Pi 4 may have had a power failure during the first boot filesystem expansion step, leading to corrupt filesystem metadata and lost files. If it were on my lab bench, I’d set up a second Pi 4, then power down, extract each microSD card, image them, and look for filesystem-level differences with forensic tools or recursive binary diff. If I didn’t have a spare Pi 4, I’d use a second microSD card on the same Pi 4.
Hope that helps.