fix(ci): bound apt-get and retry it, so a stuck mirror fails fast

[ewanc26]

What this changes

Every apt-get call in .github/workflows/ci.yml now runs under timeout (300 s for update, 900 s for install) and is retried up to three times. If all three attempts fail the step fails, instead of waiting on a hung mirror.

Why: the Install system dependencies step hung for over an hour on main runs, and release waits on CI gate, so the v0.37.0 release was blocked.

Verification

YAML parses (yaml.safe_load). The PR's own CI runs the edited workflow; that is the test. Not run locally: the runners are Ubuntu.

Docs

CHANGELOG entry.

Changelog: CHANGELOG.md

Checklist

• CI is green (CI gate and flow / conventions)
• No secrets, tokens or signing keys in the diff
• Tests added or changed with the behaviour; none skipped, disabled or deleted

🤖 Generated with Claude Code