ci: retry system deps through a resolver blip

The runner's ephemeral job containers lost DNS for three minutes and took
four builds down with them on 2026-08-13, none of them for a code reason.

Retries both commands, not just the install: apt-get update exits 0 when
every index fails to fetch, warning that it used the old ones instead.

.gitea/workflows/ci.yml

@@ -20,7 +20,25 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install system deps
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq libasound2-dev libchafa-dev libwayland-dev
+        # Retried because the runner's ephemeral job containers lose DNS for
+        # minutes at a time (four builds lost on 2026-08-13). A transient
+        # resolver blip must not decide whether our build passes, for the same
+        # reason the tuie pin exists below.
+        #
+        # The retry wraps *both* commands: `apt-get update` exits 0 when every
+        # index fails to download — it warns "old ones used instead" — so only
+        # the install reports the failure.
+        run: |
+          for attempt in 1 2 3; do
+            if sudo apt-get update -qq \
+               && sudo apt-get install -y -qq libasound2-dev libchafa-dev libwayland-dev; then
+              exit 0
+            fi
+            echo "system deps attempt $attempt failed; retrying in $((attempt * 15))s"
+            sleep $((attempt * 15))
+          done
+          echo "system deps unavailable after 3 attempts — check runner DNS"
+          exit 1
       # Pinned fork on our Gitea (rgb patch committed there) — upstream HEAD
       # must never decide whether our build passes.
       - name: Clone tuie (pinned fork)