ci: bound the ffmpeg apt fetch so a stalled mirror costs a retry, not the job

Hosted runners intermittently stall on an apt mirror, and an unbounded
apt-get inherits the whole job budget. The producer integration lane normally
finishes in ~11 minutes against a 20 minute cap; on a stalled fetch it ran to
the cap and failed. Same step, same shape, reproduces on main's tip — it is not
specific to any one PR.

The cost is not one red check. On the run that prompted this, four went red off
that single step: the two jobs that install ffmpeg, plus a Test gate and a
preview-regression gate that both fail closed when their dependency does not
succeed. So a mirror stall reads as a producer defect and a preview defect.

Each attempt is now bounded and retried three times, and the five workflows
that installed ffmpeg share one action instead of five copies of the command.
Deliberately still apt: caching the binary would strip it from the shared
libraries it links against, and switching to a static build would change the
ffmpeg under the producer's output comparisons. Neither belongs in a fix for a
network stall.

Author: miguel-heygen

.github/actions/install-ffmpeg-linux/action.yml

@@ -0,0 +1,32 @@
+name: Install ffmpeg (Linux)
+description: >-
+  Install ffmpeg from apt with a bounded, retried fetch.
+
+  Hosted runners intermittently stall on an apt mirror, and an unbounded
+  `apt-get` inherits the whole job budget: the producer integration lane
+  normally finishes in ~11 minutes against a 20 minute cap, so one stalled
+  fetch took the job to the cap and failed it. Three jobs then went red off
+  that single step, because the gates downstream fail closed on a skip.
+
+  Bounding each attempt turns a stalled mirror into a retry that costs
+  seconds rather than the job. This deliberately keeps apt as the source, so
+  the ffmpeg build under the producer's output comparisons does not change.
+
+runs:
+  using: composite
+  steps:
+    - name: Install ffmpeg
+      shell: bash
+      run: |
+        set -euo pipefail
+        for attempt in 1 2 3; do
+          if sudo timeout 120 apt-get update -qq \
+            && sudo timeout 300 apt-get install -y --no-install-recommends ffmpeg; then
+            ffmpeg -version | head -1
+            exit 0
+          fi
+          echo "::warning::apt attempt ${attempt} did not complete; retrying"
+          sleep $((attempt * 10))
+        done
+        echo "::error::ffmpeg install did not complete after 3 bounded attempts"
+        exit 1

.github/workflows/catalog-previews.yml

@@ -66,7 +66,7 @@ jobs:
       # file copy), so the job never needed it and ubuntu-latest does not ship
       # it.
       - name: Install ffmpeg
-        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
 
       - name: Render changed block/component previews
         env:

.github/workflows/ci.yml

@@ -322,9 +322,7 @@ jobs:
           node-version: 22
       - name: Install FFmpeg for integration tests
         if: matrix.lane == 'integration'
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
       - uses: ./.github/actions/prepare-ffmpeg-bin
       - run: bash scripts/ci/install-workspace-dependencies.sh
       - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
@@ -733,9 +731,7 @@ jobs:
         with:
           node-version: 22
       - name: Install FFmpeg
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
       - uses: ./.github/actions/prepare-ffmpeg-bin
       - name: Install dependencies
         run: bash scripts/ci/install-workspace-dependencies.sh

.github/workflows/player-perf.yml

@@ -105,9 +105,7 @@ jobs:
       # to just install it here so the shard never trips on infra.
       - name: Install ffmpeg (parity shard only)
         if: matrix.shard == 'parity'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
           ffmpeg -version | head -n 1
 
       - name: Run player perf — ${{ matrix.shard }} (measure mode)

.github/workflows/preview-regression.yml

@@ -93,7 +93,7 @@ jobs:
         run: bun run --cwd packages/producer parity:fixtures:ci
 
       - name: Install ffmpeg
-        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
 
       - name: Set up Chrome
         id: setup-chrome