fix(ci): shrink per-attempt install timeout, add more retries

[Wikid82]

Summary

PR #1267's "chore: scope E2E pull_request paths" run surfaced a real gap in the apt reliability hardening from #1263/#1265: the apt.conf.d Acquire::http::Timeout/Acquire::Retries tuning does not reliably abort a connection that stalls completely mid-transfer after already receiving some bytes. Observed directly in the failing job (E2E Firefox Security Enforcement):

19:06:45  Get:2 fonts-ipafont-gothic [3513 kB]   ← completes
19:10:16  Get:3 fonts-freefont-ttf [5641 kB]     ← request issued
19:15:49  (5.5 min of total silence, then our 10m outer timeout fires)

On this runner's apt implementation, Acquire::http::Timeout appears to mostly govern connection setup rather than acting as an ongoing no-progress watchdog once a transfer is already in flight — a connection that goes silent mid-download isn't aborted by that config, regardless of the configured value.

Fix

The one mechanism that has proven reliable every single time this class of issue has come up this session is the outer bash timeout wrapper — it fires and kills cleanly on schedule without exception. Shrink it from 10m to 3m per attempt and increase attempts from 3 to 5, so a stalled connection gets abandoned much faster and there are more chances at a working connection, while keeping worst-case total time per install (5 × 3m + 4 × 15s retry sleeps ≈ 16 min) well below the previous worst case (~30+ min for 3 × 10m).

The apt.conf.d hardening from #1263 is left in place — still correct/harmless, just insufficient on its own for this specific stall shape.

Test plan

• actionlint clean
• lefthook run pre-commit clean
• Confirmed all 10 install-retry sites updated consistently (timeout 3m, 5 attempts, updated messages), no stale 10m/1 2 3 references remain

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

⚠️ Supply Chain Verification Results

⚠️ WARNING

📦 SBOM Summary

• Components: 1753

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	2
🟡 Medium	5
🟢 Low	2
Total	13

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}