ci: bound the ffmpeg apt fetch so a stalled mirror costs a retry, not the job

.github/actions/install-ffmpeg-linux/action.yml

@@ -0,0 +1,34 @@
+name: Install ffmpeg (Linux)
+description: >-
+  Install ffmpeg from apt, resilient to a slow or stalling mirror.
+
+  Hosted runners hit `azure.archive.ubuntu.com` at wildly varying speeds: the
+  same install has taken 40 seconds and 15 minutes on consecutive runs, and a
+  stalled connection used to hang until the job's own timeout killed it. That
+  cost more than one red check, because the gates downstream fail closed when a
+  dependency does not succeed — a single slow fetch showed up as a producer
+  defect and a preview defect at once.
+
+  The bound belongs on the connection, not on the command. `Acquire::Retries`
+  re-fetches the individual package that stalled while keeping everything
+  already downloaded, and `Acquire::http::Timeout` caps how long any one
+  connection may sit idle. Wrapping the whole command in a wall-clock kill
+  looks similar but behaves worse: it discards a download that was making
+  progress and starts it over, which turns a slow mirror into a slower one.
+
+runs:
+  using: composite
+  steps:
+    - name: Install ffmpeg
+      shell: bash
+      env:
+        # Idle-connection cap, and per-package retries that keep prior progress.
+        APT_RESILIENCE: >-
+          -o Acquire::Retries=3
+          -o Acquire::http::Timeout=30
+          -o Acquire::https::Timeout=30
+      run: |
+        set -euo pipefail
+        sudo apt-get $APT_RESILIENCE update -qq
+        sudo apt-get $APT_RESILIENCE install -y --no-install-recommends ffmpeg
+        ffmpeg -version | head -1

.github/workflows/catalog-previews.yml

@@ -66,7 +66,7 @@ jobs:
       # file copy), so the job never needed it and ubuntu-latest does not ship
       # it.
       - name: Install ffmpeg
-        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
 
       - name: Render changed block/component previews
         env:

.github/workflows/ci.yml

@@ -322,9 +322,7 @@ jobs:
           node-version: 22
       - name: Install FFmpeg for integration tests
         if: matrix.lane == 'integration'
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
       - uses: ./.github/actions/prepare-ffmpeg-bin
       - run: bash scripts/ci/install-workspace-dependencies.sh
       - run: bun run --filter '@hyperframes/{parsers,lint,studio-server}' build
@@ -733,9 +731,7 @@ jobs:
         with:
           node-version: 22
       - name: Install FFmpeg
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
       - uses: ./.github/actions/prepare-ffmpeg-bin
       - name: Install dependencies
         run: bash scripts/ci/install-workspace-dependencies.sh

.github/workflows/player-perf.yml

@@ -105,10 +105,7 @@ jobs:
       # to just install it here so the shard never trips on infra.
       - name: Install ffmpeg (parity shard only)
         if: matrix.shard == 'parity'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ffmpeg
-          ffmpeg -version | head -n 1
+        uses: ./.github/actions/install-ffmpeg-linux
 
       - name: Run player perf — ${{ matrix.shard }} (measure mode)
         working-directory: packages/player

.github/workflows/preview-regression.yml

@@ -93,7 +93,7 @@ jobs:
         run: bun run --cwd packages/producer parity:fixtures:ci
 
       - name: Install ffmpeg
-        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends ffmpeg
+        uses: ./.github/actions/install-ffmpeg-linux
 
       - name: Set up Chrome
         id: setup-chrome