ci(workflows): make apt fetches fail fast and retry instead of hanging (#507)

The Ubuntu mirror intermittently accepts a connection and then stops
sending data. apt has no read timeout by default, so it blocks forever:
run 29012965487 stalled 8.5 min on the 25 MB libwebkit2gtk-4.1-0 fetch
and the Desktop backend job was killed by its 20 min timeout-minutes
without compiling a single line of Rust.

Set a 30s read timeout so a stalled transfer aborts, and 3 retries so
apt re-fetches (picking another mirror) instead of failing the job.
Applied to both apt-using jobs via a shared env var.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Milhouszhang

.github/workflows/ci.yml

@@ -31,6 +31,11 @@ env:
   # tests — which are terminal-/timing-fragile in CI and fail deterministically.
   # Force them to skip; they still run locally for anyone who wants them.
   PUFFER_SKIP_TMUX_TESTS: "1"
+  # The Ubuntu mirror intermittently accepts a connection then stops sending.
+  # apt has no read timeout by default, so it hangs until the job's
+  # timeout-minutes kills it (seen on the 25 MB libwebkit2gtk-4.1-0 fetch).
+  # Timeout turns the hang into a failure; Retries then re-fetches it.
+  APT_RESILIENCE: -o Acquire::http::Timeout=30 -o Acquire::Retries=3
 
 jobs:
   rust:
@@ -43,7 +48,9 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
+        run: |
+          sudo apt-get $APT_RESILIENCE update
+          sudo apt-get $APT_RESILIENCE install -y pkg-config libssl-dev
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -227,8 +234,8 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          sudo apt-get update
-          sudo apt-get install -y pkg-config libssl-dev libwebkit2gtk-4.1-dev \
+          sudo apt-get $APT_RESILIENCE update
+          sudo apt-get $APT_RESILIENCE install -y pkg-config libssl-dev libwebkit2gtk-4.1-dev \
             libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev
 
       - uses: dtolnay/rust-toolchain@stable