fix(workflow): stop apt-get update hangs from killing read-only skill runs

.github/workflows/aeon.yml

@@ -333,11 +333,25 @@ jobs:
         # each a ~50-min hang on this exact step). timeout-minutes fails the step
         # fast; DPkg::Lock::Timeout waits a bounded time for the lock instead of
         # hanging indefinitely.
+        # The lock is not the only stall: on 2026-10-07 `apt-get update` itself hung
+        # on a slow mirror for the full 5 min and killed an aeon-agent tweet-digest run
+        # before it ran. So try the install from the image's cached package lists
+        # first (no network index refresh), and only refresh on a miss, with each
+        # update capped at 90s and retried once. Acquire timeouts stop a single dead
+        # mirror from hanging.
         timeout-minutes: 5
         run: |
           set -euo pipefail
-          APT_OPTS="-o DPkg::Lock::Timeout=120"
-          sudo apt-get $APT_OPTS update -qq && sudo apt-get $APT_OPTS install -y -qq bubblewrap
+          APT_OPTS="-o DPkg::Lock::Timeout=120 -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20"
+          if ! command -v bwrap >/dev/null 2>&1; then
+            if ! sudo apt-get $APT_OPTS install -y -qq bubblewrap; then
+              for attempt in 1 2; do
+                sudo timeout 90 apt-get $APT_OPTS update -qq && break
+                echo "::warning::apt-get update attempt $attempt timed out or failed"
+              done
+              sudo apt-get $APT_OPTS install -y -qq bubblewrap
+            fi
+          fi
           # Ubuntu 24.04 (including GitHub's ubuntu-latest) restricts unprivileged
           # user namespaces via AppArmor, so bwrap dies with 'setting up uid map:
           # Permission denied' and run-harness fails CLOSED on every read-only

.github/workflows/ci-harness-cli.yml

@@ -83,8 +83,18 @@ jobs:
         timeout-minutes: 5
         run: |
           set -euo pipefail
-          APT_OPTS="-o DPkg::Lock::Timeout=120"
-          sudo apt-get $APT_OPTS update -qq && sudo apt-get $APT_OPTS install -y -qq bubblewrap
+          # Cached lists first; refresh only on a miss, each update capped at 90s
+          # (a slow mirror hung `apt-get update` past the step cap on 2026-10-07).
+          APT_OPTS="-o DPkg::Lock::Timeout=120 -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20"
+          if ! command -v bwrap >/dev/null 2>&1; then
+            if ! sudo apt-get $APT_OPTS install -y -qq bubblewrap; then
+              for attempt in 1 2; do
+                sudo timeout 90 apt-get $APT_OPTS update -qq && break
+                echo "::warning::apt-get update attempt $attempt timed out or failed"
+              done
+              sudo apt-get $APT_OPTS install -y -qq bubblewrap
+            fi
+          fi
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
           bwrap --dev-bind / / --ro-bind /tmp /tmp true && echo 'bwrap: userns OK'
       - name: Install, version, flags, and fake-upstream round trip

.github/workflows/ci-tests.yml

@@ -67,8 +67,18 @@ jobs:
         timeout-minutes: 5
         run: |
           set -euo pipefail
-          APT_OPTS="-o DPkg::Lock::Timeout=120"
-          sudo apt-get $APT_OPTS update -qq && sudo apt-get $APT_OPTS install -y -qq bubblewrap
+          # Cached lists first; refresh only on a miss, each update capped at 90s
+          # (a slow mirror hung `apt-get update` past the step cap on 2026-10-07).
+          APT_OPTS="-o DPkg::Lock::Timeout=120 -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20"
+          if ! command -v bwrap >/dev/null 2>&1; then
+            if ! sudo apt-get $APT_OPTS install -y -qq bubblewrap; then
+              for attempt in 1 2; do
+                sudo timeout 90 apt-get $APT_OPTS update -qq && break
+                echo "::warning::apt-get update attempt $attempt timed out or failed"
+              done
+              sudo apt-get $APT_OPTS install -y -qq bubblewrap
+            fi
+          fi
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
           bwrap --dev-bind / / --ro-bind /tmp /tmp true && echo 'bwrap: userns OK'
       - name: notify_format unit tests