ci: harden Ubuntu audio-dep install against slow apt mirrors

The Ubuntu `lint + typecheck + tests` cells kept timing out at the
"System deps (PortAudio + ffmpeg)" step and getting cancelled before the
tests ran, which bounced this PR out of the merge queue. Root cause: a plain
`apt-get install ffmpeg` pulls a ~100-package / ~94 MB dependency closure, and
against a degraded Azure Ubuntu mirror that download overran the job's 15-min
timeout. Windows was unaffected (it installs only ffmpeg, in under a minute).

Factor the three identical Ubuntu installs into scripts/ci_install_audio_deps.sh
that (1) passes --no-install-recommends to drop the optional codec/VA-API/SDL
recommends that balloon the payload, and (2) wraps each apt call in a bounded
`timeout` + retry so a stalled mirror connection is killed and retried instead
of wedging the whole job. Bump the two Ubuntu test jobs from 15 to 20 minutes
(matching the Windows job) to give the retry path headroom.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFrwHX8EdECmkNsU8LqJNf

Author: claude

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
   check:
     name: lint + typecheck + tests (py${{ matrix.python-version }})
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     # Test both ends of the supported range: 3.12 is the floor (requires-python),
     # 3.13 is what the Homebrew formula ships. fail-fast off so one version's
     # failure doesn't mask the other's.
@@ -49,8 +49,9 @@ jobs:
 
       # PortAudio backs sounddevice; ffmpeg decodes non-WAV/URL audio (the `--sample`
       # stream tests build a FileSource for the hosted sample, which needs ffmpeg).
+      # Slow-mirror resilience (bounded retry + trimmed payload) lives in the script.
       - name: System deps (PortAudio + ffmpeg)
-        run: sudo apt-get update && sudo apt-get install -y libportaudio2 ffmpeg
+        run: ./scripts/ci_install_audio_deps.sh
 
       # check.sh lints Markdown and template JS/CSS via Node CLIs; versions are
       # pinned in scripts/gate_tool_pins.sh (shared with the web session-start
@@ -245,7 +246,7 @@ jobs:
   pre-commit:
     name: pre-commit
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -257,7 +258,7 @@ jobs:
 
       # PortAudio backs sounddevice; ffmpeg decodes the `--sample` stream source.
       - name: System deps (PortAudio + ffmpeg)
-        run: sudo apt-get update && sudo apt-get install -y libportaudio2 ffmpeg
+        run: ./scripts/ci_install_audio_deps.sh
 
       # The local pytest hook runs `uv run --frozen python -m pytest`, so the tests
       # resolve the LOCKED dependency versions (uv.lock) rather than the newest
@@ -341,7 +342,7 @@ jobs:
       # PortAudio + ffmpeg so `assembly --help` (which imports the full command
       # tree) loads cleanly; also lets install.sh's dep check find them present.
       - name: System deps (PortAudio + ffmpeg)
-        run: sudo apt-get update && sudo apt-get install -y libportaudio2 ffmpeg
+        run: ./scripts/ci_install_audio_deps.sh
 
       - name: Run install.sh (editable, from this checkout)
         run: ./install.sh --install-method git

scripts/ci_install_audio_deps.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# CI-only helper: install the Linux system audio deps the suite needs — libportaudio2
+# (sounddevice's PortAudio backend) and ffmpeg (decodes non-WAV/URL audio for the
+# `--sample` stream tests). Three Ubuntu jobs in .github/workflows/ci.yml install the
+# identical pair, so the slow-mirror resilience below lives in one place.
+#
+# A plain `apt-get install ffmpeg` pulls a ~100-package / ~94 MB dependency closure, and
+# against a degraded Azure Ubuntu mirror that download has repeatedly overrun the job's
+# timeout — the step hung mid-download and was cancelled before the tests ran, bouncing
+# the PR out of the merge queue. Two mitigations, mirroring the Windows ffmpeg step's
+# bounded-retry philosophy:
+#   * --no-install-recommends drops the optional VA-API/VDPAU/SDL/pocketsphinx recommends
+#     that balloon the download; the ffmpeg binary and the libs the tests load remain.
+#   * each apt call is wrapped in `timeout` (run under sudo so the killer is root and can
+#     actually reap apt) and retried, so a connection that stalls on a bad mirror edge is
+#     killed and retried instead of wedging the whole job; apt's own Acquire::Retries
+#     handles transient per-file failures within an attempt.
+set -euo pipefail
+
+# Run one bounded apt-get attempt, retrying a stalled/failed call a few times.
+apt_retry() {
+  local attempt
+  for attempt in 1 2 3; do
+    if sudo timeout --kill-after=10s 120s apt-get "$@"; then
+      return 0
+    fi
+    echo "::warning::apt-get $* failed or stalled (attempt ${attempt}/3); retrying" >&2
+    sleep "$((attempt * 5))"
+  done
+  echo "::error::apt-get $* failed after 3 attempts" >&2
+  return 1
+}
+
+apt_retry update -o Acquire::Retries=3
+apt_retry install -y --no-install-recommends -o Acquire::Retries=3 libportaudio2 ffmpeg