fix(release): bound engine provisioning and Linux package setup

- abort locked engine downloads and extraction on process interruption
- recover only dead-PID staging trees while preserving active and legacy trees
- normalize Ubuntu mirrors and bound apt in release jobs
- cover cancellation, orphan cleanup, and workflow contracts with focused tests

.github/workflows/release.yml

@@ -63,8 +63,27 @@ jobs:
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
+          # Hosted Ubuntu images can expose an unreachable Azure mirror in
+          # their apt sources while the public Ubuntu archive is reachable.
+          # Keep release jobs bounded and use the same source normalization as
+          # the native CI path so a runner-local mirror cannot hang packaging.
+          sudo find /etc/apt -type f \
+            -exec sed -i \
+              -e 's#http://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              -e 's#https://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              {} +
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            update
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            install -y \
             libwebkit2gtk-4.1-dev \
             libappindicator3-dev \
             librsvg2-dev \