ci: apt retries, message-pins permissions, protocol-drift concurrency

.github/actions/fast-apt/action.yml

@@ -1,17 +1,18 @@
 name: Fast apt on arm64 runners
 description: >-
-  Point Ubuntu package sources at the official ports mirror and set apt retry/timeout
-  defaults. The default Azure mirror (azure.archive.ubuntu.com) took 15-34 minutes for
-  dependency installs on arm64 runners (runs 40418762416, 40418762747, 40482489505).
-  No-op on non-arm64 runners. Prints the resulting URIs so logs show it took effect.
+  Set apt retry/timeout defaults on every runner, and on arm64 point Ubuntu package
+  sources at the official ports mirror. The default Azure mirror (azure.archive.ubuntu.com)
+  took 15-34 minutes for dependency installs on arm64 runners (runs 40418762416,
+  40418762747, 40482489505) and stalls mid-download on amd64 too, so retries apply to
+  both. Prints the resulting URIs so logs show it took effect.
 runs:
   using: composite
   steps:
     - shell: bash
       run: |
+        printf 'Acquire::Retries "5";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \
+          | sudo tee /etc/apt/apt.conf.d/80-retries >/dev/null
         [ "$(dpkg --print-architecture)" = arm64 ] || exit 0
-        printf 'Acquire::Retries "3";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \
-          | sudo tee /etc/apt/apt.conf.d/99ci-fast >/dev/null
         f=/etc/apt/sources.list.d/ubuntu.sources
         if [ -f "$f" ]; then
           # Replace the whole line: the runner may use azure.archive.ubuntu.com or mirror+file:.

.github/workflows/message-pins.yml

@@ -18,6 +18,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   linux-import:
     name: Native pin import and private keyring (Linux)

.github/workflows/mseries-battery-app.yml

@@ -29,6 +29,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
+      - uses: ./.github/actions/fast-apt
 
       - name: Install test dependencies
         run: |

.github/workflows/mseries-image-studio.yml

@@ -35,6 +35,7 @@ jobs:
       CARGO_TARGET_DIR: ${{ github.workspace }}/../mseries-image-studio-target
     steps:
       - uses: actions/checkout@v7
+      - uses: ./.github/actions/fast-apt
 
       - name: Install build and test dependencies
         run: |

.github/workflows/protocol-drift.yml

@@ -12,6 +12,11 @@ on:
 permissions:
   contents: read
 
+# One run per ref at a time; a scheduled or manual run is never cancelled mid-check.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   compare:
     runs-on: ubuntu-latest