fix(ci): recover signed Ubuntu dependencies during DNS outages

.github/workflows/ci.yml

@@ -8,6 +8,13 @@ on:
   # Manual runs compare server shard counts against a fixed weights source.
   workflow_dispatch:
     inputs:
+      apt_route:
+        description: Ubuntu dependency route (candidate qualifies the isolated fallback)
+        type: choice
+        options:
+          - auto
+          - candidate
+        default: auto
       server_shards:
         description: Number of server test shards
         type: choice
@@ -386,7 +393,9 @@ jobs:
         run: vp run --filter @t3tools/desktop ensure:electron
 
       - name: Install browser secret helper build libraries
-        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+        env:
+          JONES_CI_APT_ROUTE: ${{ inputs.apt_route }}
+        run: node scripts/jones/ci/apt-setup.mjs libsecret-1-dev pkg-config
 
       - name: Build desktop pipeline
         run: vp run build:desktop
@@ -450,9 +459,10 @@ jobs:
       # and soft-skip when it is missing. Install build-essential so that path
       # always runs in CI instead of silently no-oping.
       - name: Install native test build dependencies
+        env:
+          JONES_CI_APT_ROUTE: ${{ inputs.apt_route }}
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends build-essential libsecret-1-dev pkg-config
+          node scripts/jones/ci/apt-setup.mjs --no-install-recommends build-essential libsecret-1-dev pkg-config
           command -v cc
 
       - name: Setup Vite+
@@ -551,9 +561,10 @@ jobs:
           test "$(git rev-parse HEAD)" = "$JONES_CHECKOUT_SHA"
 
       - name: Install native test build dependencies
+        env:
+          JONES_CI_APT_ROUTE: ${{ inputs.apt_route }}
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends build-essential libsecret-1-dev pkg-config
+          node scripts/jones/ci/apt-setup.mjs --no-install-recommends build-essential libsecret-1-dev pkg-config
           command -v cc
 
       - name: Setup Vite+

scripts/jones/boundary/checks.json

@@ -3199,9 +3199,12 @@
     },
     {
       "id": "jones-ci-dependency-setup",
-      "tests": ["scripts/jones/ci/chromium-setup.node-test.mjs"],
+      "tests": [
+        "scripts/jones/ci/chromium-setup.node-test.mjs",
+        "scripts/jones/ci/apt-setup.node-test.mjs"
+      ],
       "commands": [
-        "node --test scripts/jones/ci/chromium-setup.node-test.mjs",
+        "node --test --test-concurrency=1 scripts/jones/ci/chromium-setup.node-test.mjs scripts/jones/ci/apt-setup.node-test.mjs",
         "node scripts/jones/check-boundary.ts --strict --json"
       ]
     },

scripts/jones/boundary/features.json

@@ -1967,8 +1967,11 @@
     },
     {
       "id": "ci-dependency-setup",
-      "tests": ["scripts/jones/ci/chromium-setup.node-test.mjs"],
-      "scope": "CI resolves Chromium from each workspace, checks a real headless launch before installing system dependencies, and verifies a single repair attempt. Browser caching follows the upstream versioned key; native compiler and libsecret package setup is consolidated without changing tests or server sharding."
+      "tests": [
+        "scripts/jones/ci/chromium-setup.node-test.mjs",
+        "scripts/jones/ci/apt-setup.node-test.mjs"
+      ],
+      "scope": "CI resolves Chromium from each workspace, checks a real headless launch before installing system dependencies, and verifies a single repair attempt. Browser caching follows the upstream versioned key; native compiler and libsecret package setup is consolidated without changing tests or server sharding. Three primary Ubuntu dependency steps use strict signed refresh and download before offline install. Only proven transport failures or clean deadlines permit candidate-only isolated lists and archives, with exact source/keyring and cold index-target validation plus acquired freshness checks. An owned process-group gate proves termination before fallback or removal; cancellation and unknown cleanup stop. Injected tests cover route, trust, process and workspace boundaries; the Linux process regression runs in the existing CI Node test group. Candidate runner qualification remains required."
     },
     {
       "id": "child-input-navigation",