fix(ci): harden verify against flaky packages.microsoft.com apt source (#2975)

[rysweet]

Fixes #2975.

Problem (grounded in run data, not assumed)

verify intermittently reds the default branch when the GitHub-hosted
runner's packages.microsoft.com apt repositories serve an invalid InRelease:

E: Failed to fetch https://packages.microsoft.com/.../InRelease  Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
E: The repository '... noble InRelease' is no longer signed.

Any apt-get update on the runner then exits 100 and fails the job. Two main
verify runs failed at 20:43 UTC 2026-07-07 from this single cause:

Run	Job	Failing step	Failure
28897370109	pre-commit	rust-runner-prep → apt-get update -qq	exit 100 (NOSPLIT)
28897367724	e2e-dashboard	npx playwright install --with-deps (internal apt-get update)	Failed to install browsers, exit 100

The next main run (21:00, 28898321760) was green only because the
Microsoft repo happened to be valid again. This is a recurring, non-deterministic
source of spurious red — not a code regression that "self-recovered."

Fix

None of the CI jobs need the Microsoft repos; they install mold and Playwright
browser deps from the Ubuntu archive. Add scripts/ci-harden-apt.sh to strip
any apt source referencing packages.microsoft.com before every apt-get update,
and wire it into both entry points:

• .github/actions/rust-runner-prep/action.yml — before apt-get update -qq (covers pre-commit and install-real)
• .github/workflows/verify.yml e2e-dashboard job — before npx playwright install --with-deps

The script is idempotent (safe to re-run; skips already-disabled lines) and
non-fatal (removing an unneeded source can only help). It handles both
sources.list.d/*.list/*.sources (deb822) files and the monolithic
sources.list.

Evidence for merge-ready criteria

1. Tests / behavioral validation. This is a CI-infrastructure change with no
product runtime surface, so gadugi/qa-team scenarios do not apply. The script was
validated with a sandboxed functional + idempotency test (never touching the
host /etc/apt) asserting: MS .list and deb822 .sources files removed;
google-chrome.list and Ubuntu-archive lines preserved verbatim; active MS line
in sources.list disabled exactly once; pre-commented MS lines untouched; RUN 2
reports "nothing to do" (idempotent). All assertions PASS.

2. Docs / changed surfaces. Changed surfaces are internal CI only
(.github/** + scripts/ci-harden-apt.sh). No user-facing runtime, CLI, or API
surface changes — no end-user docs required. Rationale is documented inline in
each workflow step and the script header.

3. Quality audit (SEEK → VALIDATE → FIX).

• Cycle 1 — SEEK: static analysis. bash -n, shellcheck (clean), actionlint (clean), YAML parse (both files). VALIDATE: pass.
• Cycle 2 — SEEK: sandboxed functional test. FOUND a real idempotency bug — the sources.list branch re-commented already-disabled MS lines, stacking # disabled-by-ci: prefixes. FIX: restrict the condition + sed to active (non-comment) MS lines only.
• Cycle 3 — VALIDATE: re-ran static + sandboxed functional + idempotency (double-run) tests → clean; RUN 2 = "nothing to do". Zero remaining findings.

4. CI. Full verify runs on this branch/PR; will confirm 100% green before
marking ready. (CI green here also proves the fix is safe: mold and Playwright
deps still install from the Ubuntu archive after the MS sources are removed.)

6. Focused diff. 3 files, +79/-0: one new script + two one-step wire-ins.
No unrelated edits.

[rysweet]

Superseded by #4115 (same CI-health steward goal, current instance). #4115 carries the same packages.microsoft.com apt-hardening fix rebased on latest main, plus the regression rigor this PR lacked: a Rust wiring guard (tests/ci_harden_apt_wiring.rs) and a validated+run gadugi-test qa-team scenario (tests/gadugi/ci-harden-apt.{yaml,sh}). Closing to keep one PR per distinct failure (#2975).