ci: retry apt-get (or mirror fallback) in checks.yml tests job #456

Problem

In .github/workflows/checks.yml:57, every tests shard runs one bare command with no retry:

sudo apt-get update -q && sudo apt-get install -y -q --no-install-recommends ripgrep python3-pil poppler-utils

On 2026-11-11, runner DNS failed for about 3 hours ("Temporary failure resolving azure.archive.ubuntu.com / archive.ubuntu.com / security.ubuntu.com / ports.ubuntu.com"). Attempts 1–7 of run https://github.com/chayapats/jit/actions/runs/43044244466 (PR #455) failed at this step on x64 and arm64. bun test never started in any of them. The PR did not touch any workflow file. Attempt 8 passed with no code change.

Proposal (small, CI-only)

• Wrap apt in a bounded retry with backoff, e.g. -o Acquire::Retries=5, plus a shell loop of about 3 tries with sleeps of 10, 30 and 60 s around apt-get update/install.
• Optional: fall back to another mirror (e.g. mirror+file: list or azure.archive → archive) when resolution fails, or cache the three packages.
• Keep the step's failure loud after the retries run out. Do not silently skip the packages, because the parser fixtures need them.

Acceptance

• checks.yml retries the apt step before it fails the job.
• No change to test selection or sharding.
• CI is green on the PR.

Found during #455 (Tria's ruling: track this separately, not inside #455).