fix(fullstack): make tier-2 chromium install resilient to a dead apt mirror (#1077)

* fix: pre-alpha.2 hygiene sweep — full-repo scan findings

Scan of HEAD after the closure train (5 parallel probes, baseline
docs/audit/2026-08-17-deep-repo-scan.md) found 12 items; all fixed:

- client-router guard concurrency: a nested guard redirect now carries
  the captured seq as its ticket, so a stale guard can no longer
  replaceState over a newer programmatic navigation; programmatic commits
  invalidate the landed-URL dedup key so a real back onto a
  veto-restored entry re-syncs the router. Two regression tests;
  ADR-0133 argues the ADR-0122 frozen contracts are preserved.
- open-dropdown: re-sync both anchor-name halves from the client realm
  on connect (module-level counter diverges across multi-page SSG);
  component-recipes comment now tells the truth about realm uniqueness.
- nav content plugin: regenerate-on-change dev watcher (parity with the
  blog plugin).
- tools: drop dead exports (RELEASE_STATE, gitIsTracked); fix comments
  naming the deleted check-www-current-truth.ts; docs-truth header lists
  all seven gates; evidence gate fails closed when a release note is
  missing (was fail-open); rename the orphaned test file.
- starter: single-source ATTACHMENT_BUCKET; rename the rate-limit
  WorkerEnv to RateLimitEnv; .env.example header no longer contradicts
  the env list; README qualification section reflects the closed gates.
- workflows: consumer-smoke falls back to PACKAGE_VERSION on an empty
  --version (was a guaranteed failure or false-green skip); drop the
  dangling verify:configs:fix task; deploy-smoke queue names cross-refer
  the canonical constants with a new parity test.

Verification: deno task test 1607/0, fmt, lint, arch:check,
freeze:semantics:check, docs:truth (incl. recipe parity),
fullstack:boundary-check all green.

* fix(fullstack): make tier-2 chromium install resilient to a dead apt mirror

azure.archive.ubuntu.com hung apt twice on 2026-08-19, stalling
'playwright install --with-deps' past the 30-minute job timeout (two
cancelled evidence runs, no code involved). Repoint apt at the canonical
archive and bound acquire timeouts so a dead mirror fails fast.

---------

Co-authored-by: DevBot <devbot@openelement.dev>

Author: SisyphusZheng

.github/workflows/supabase-project-smoke.yml

@@ -92,7 +92,17 @@ jobs:
           echo "$output" | grep -q 'Remote database is up to date.'
 
       - name: Install Chromium for the real browser journey
-        run: ./node_modules/.bin/playwright install --with-deps chromium
+        run: |
+          set -euo pipefail
+          # Runner apt resilience: azure.archive.ubuntu.com (the hosted-runner
+          # default mirror) hung apt twice on 2026-08-19, stalling this step
+          # until the job timeout. Point apt at the canonical archive and
+          # bound every acquire so a dead mirror fails fast instead.
+          sudo sed -i 's|http://azure\.archive\.ubuntu\.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' \
+            /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true
+          echo 'Acquire::http::Timeout "20"; Acquire::https::Timeout "20"; Acquire::Retries "2";' \
+            | sudo tee /etc/apt/apt.conf.d/99-open-element-timeouts.conf > /dev/null
+          ./node_modules/.bin/playwright install --with-deps chromium
 
       - name: Create two throwaway test users (Auth admin API)
         run: |