ci(linux): increase bounded apt install budget for cold runners

.github/scripts/apt-retry.sh

@@ -13,8 +13,17 @@ if [[ "${1:-}" == "--sudo" ]]; then
 fi
 (( $# > 0 )) || usage
 
-attempts="${RIVET_APT_RETRY_ATTEMPTS:-2}"
-timeout_seconds="${RIVET_APT_TIMEOUT_SECONDS:-180}"
+# A complete GTK4/libsecret install can fetch 100+ packages on cold hosted
+# runners. A 180-second attempt interrupts healthy downloads mid-flight, and
+# two attempts cannot outlast a slow mirror. Update remains short; install
+# gets a larger window and one more bounded, cache-resuming attempt.
+operation="$1"
+case "$operation" in
+  install) default_timeout_seconds=480 ; default_attempts=3 ;;
+  *) default_timeout_seconds=180 ; default_attempts=2 ;;
+esac
+attempts="${RIVET_APT_RETRY_ATTEMPTS:-$default_attempts}"
+timeout_seconds="${RIVET_APT_TIMEOUT_SECONDS:-$default_timeout_seconds}"
 delay_seconds="${RIVET_APT_RETRY_DELAY_SECONDS:-10}"
 apt_get="${RIVET_APT_GET:-apt-get}"
 timeout_command="${RIVET_TIMEOUT_COMMAND:-timeout}"
@@ -41,7 +50,6 @@ if [[ "$use_sudo" == true ]]; then
   apt_command=(sudo -n "${apt_command[@]}")
 fi
 
-operation="$1"
 for (( attempt = 1; attempt <= attempts; attempt++ )); do
   echo "apt-retry: $operation attempt $attempt/$attempts (timeout ${timeout_seconds}s)"
   if "$timeout_command" --foreground --signal=TERM --kill-after=30s \

.github/scripts/test-apt-retry.sh

@@ -23,6 +23,9 @@ case "$FAKE_APT_MODE" in
   timeout)
     sleep 5
     ;;
+  success)
+    exit 0
+    ;;
   *)
     exit 64
     ;;
@@ -51,3 +54,55 @@ if bash "$script_dir/apt-retry.sh" update; then
   echo "apt-retry test expected the bounded command to fail" >&2
   exit 1
 fi
+
+# Install attempts default higher than update; explicit override still wins.
+: >"$FAKE_APT_STATE"
+export FAKE_APT_MODE=fail
+export RIVET_APT_RETRY_ATTEMPTS=1
+bash "$script_dir/apt-retry.sh" install --yes example-package || true
+[[ "$(cat "$FAKE_APT_STATE")" == 1 ]]
+unset RIVET_APT_RETRY_ATTEMPTS
+: >"$FAKE_APT_STATE"
+if bash "$script_dir/apt-retry.sh" install --yes example-package; then
+  echo "apt-retry test expected the bounded command to fail" >&2
+  exit 1
+fi
+[[ "$(cat "$FAKE_APT_STATE")" == 3 ]]
+: >"$FAKE_APT_STATE"
+if bash "$script_dir/apt-retry.sh" update; then
+  echo "apt-retry test expected the bounded command to fail" >&2
+  exit 1
+fi
+[[ "$(cat "$FAKE_APT_STATE")" == 2 ]]
+
+# Distinguish large install budgets from update without ever disabling
+# timeout enforcement. An explicit caller override still takes precedence.
+fake_timeout="$work/fake-timeout"
+cat >"$fake_timeout" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "$*" >>"$FAKE_TIMEOUT_ARGS"
+while (( $# > 0 )); do
+  case "$1" in
+    --foreground|--signal=*|--kill-after=*) shift ;;
+    *s) shift; break ;;
+    *) exit 64 ;;
+  esac
+done
+"$@"
+SH
+chmod +x "$fake_timeout"
+export RIVET_TIMEOUT_COMMAND="$fake_timeout"
+export FAKE_TIMEOUT_ARGS="$work/timeout-arguments"
+export FAKE_APT_MODE=success
+export RIVET_APT_RETRY_ATTEMPTS=1
+unset RIVET_APT_TIMEOUT_SECONDS
+bash "$script_dir/apt-retry.sh" install --yes example-package
+grep -Fq -- '480s' "$FAKE_TIMEOUT_ARGS"
+: >"$FAKE_TIMEOUT_ARGS"
+bash "$script_dir/apt-retry.sh" update
+grep -Fq -- '180s' "$FAKE_TIMEOUT_ARGS"
+: >"$FAKE_TIMEOUT_ARGS"
+export RIVET_APT_TIMEOUT_SECONDS=9
+bash "$script_dir/apt-retry.sh" install --yes example-package
+grep -Fq -- '9s' "$FAKE_TIMEOUT_ARGS"

.github/workflows/architectures.yml

@@ -177,7 +177,7 @@ jobs:
       - name: Install GTK4 development files and rpm tooling
         run: |
           bash .github/scripts/apt-retry.sh --sudo update
-          bash .github/scripts/apt-retry.sh --sudo install --yes \
+          bash .github/scripts/apt-retry.sh --sudo install --yes --no-install-recommends \
             libgtk-4-dev rpm desktop-file-utils
       - name: Compile full schema matrix, package, and verify a GTK4 app
         shell: bash

.github/workflows/linux-installers.yml

@@ -25,7 +25,7 @@ jobs:
         run: |
           set -euo pipefail
           bash .github/scripts/apt-retry.sh --sudo update
-          bash .github/scripts/apt-retry.sh --sudo install --yes \
+          bash .github/scripts/apt-retry.sh --sudo install --yes --no-install-recommends \
             desktop-file-utils libgtk-4-dev libsecret-1-dev rpm
           raco pkg install --auto --no-docs --name rivet --link "$PWD"
       - name: Build release artifacts
@@ -128,7 +128,8 @@ jobs:
       - name: Install headless Wayland compositor
         run: |
           bash .github/scripts/apt-retry.sh --sudo update
-          bash .github/scripts/apt-retry.sh --sudo install --yes weston
+          bash .github/scripts/apt-retry.sh --sudo install --yes --no-install-recommends \
+            weston xwayland
       - name: Launch AppImage outside the build tree
         shell: bash
         env:

.github/workflows/native-ui.yml

@@ -25,9 +25,9 @@ jobs:
         run: |
           set -euo pipefail
           bash .github/scripts/apt-retry.sh --sudo update
-          bash .github/scripts/apt-retry.sh --sudo install --yes \
+          bash .github/scripts/apt-retry.sh --sudo install --yes --no-install-recommends \
             at-spi2-core dbus-x11 libgtk-4-dev libsecret-1-dev \
-            python3-pyatspi weston
+            python3-pyatspi weston xwayland
           raco pkg install --auto --no-docs --name rivet --link "$PWD"
       - name: Package and exercise the GTK4 Taskboard on native Wayland
         shell: bash

.github/workflows/roundtrip.yml

@@ -25,8 +25,8 @@ jobs:
       - name: Install Linux development files
         run: |
           bash .github/scripts/apt-retry.sh --sudo update
-          bash .github/scripts/apt-retry.sh --sudo install --yes \
-            desktop-file-utils libglib2.0-dev libsecret-1-dev libgtk-4-dev weston
+          bash .github/scripts/apt-retry.sh --sudo install --yes --no-install-recommends \
+            desktop-file-utils libglib2.0-dev libsecret-1-dev libgtk-4-dev weston xwayland
       - name: Build backend and integration runner
         shell: bash
         run: |