fix(ci): stop a stalled apt mirror from burning the job budget

scripts/install/apt.sh ran apt-get without any timeout, so a stalled mirror connection hung until the 355-minute job limit killed the job - three times across both runs (95883075054, 95883075011, 95883448555), each after roughly 5h50m of silence following the last apt line, "Get:5 noble-security InRelease". The Install-jq step carries no timeout-minutes of its own, so nothing bounded it.

Acquire retries/timeouts mirror the SPOT that 07d31d900 established for deployed hosts in roles/update/tasks/debian.yml. The timeout wrapper is the backstop for what Acquire cannot cover (dpkg lock, hanging post-install), and runs under sudo so the signal reaches apt-get itself rather than the sudo wrapper; -k 30 follows up with SIGKILL. 10m is 5.5x the slowest successful run measured in these same runs (6.7s / 41.1s / 81.3s / 109.8s).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/install/apt.sh

@@ -6,5 +6,8 @@ if (($# == 0)); then
 	exit 1
 fi
 
-sudo apt-get update
-sudo apt-get install -y "$@"
+APT_TIMEOUT=10m
+APT_OPTS=(-o Acquire::Retries=5 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30)
+
+sudo timeout -k 30 "${APT_TIMEOUT}" apt-get "${APT_OPTS[@]}" update
+sudo timeout -k 30 "${APT_TIMEOUT}" apt-get "${APT_OPTS[@]}" install -y "$@"