fix(release): bound engine provisioning and Linux package setup

- abort locked engine downloads and extraction on process interruption
- recover only dead-PID staging trees while preserving active and legacy trees
- normalize Ubuntu mirrors and bound apt in release jobs
- cover cancellation, orphan cleanup, and workflow contracts with focused tests

scripts/release-workflow.node-test.js

@@ -0,0 +1,17 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { test } from 'node:test';
+
+const repositoryRoot = path.resolve(import.meta.dirname, '..');
+const releaseWorkflow = fs.readFileSync(
+  path.join(repositoryRoot, '.github', 'workflows', 'release.yml'),
+  'utf8',
+);
+
+test('release Linux dependency installation is mirror-normalized and bounded', () => {
+  assert.match(releaseWorkflow, /azure\\\.archive\\\.ubuntu\\\.com/);
+  assert.equal((releaseWorkflow.match(/Acquire::Retries=3/g) || []).length, 2);
+  assert.equal((releaseWorkflow.match(/timeout --foreground --signal=TERM --kill-after=30s 10m apt-get/g) || []).length, 2);
+  assert.doesNotMatch(releaseWorkflow, /^\s*sudo apt-get (update|install)/m);
+});