[ixuz]

What and why

The site job failed on 2026-11-11 after 12 minutes because azure.archive.ubuntu.com didn't answer any of the four apt-get update tries. That update was the job's only use of the mirror. Playwright's check of what is missing (install-deps --dry-run, which runs apt-get install -s) reads the package lists that come with the runner image. Without the fonts (#607), the image is missing nothing, so the job had nothing to download.

.github/actions/playwright-deps now asks Playwright first and runs apt-get update only:

• just before a download, when a package is missing, or
• when the image's lists can't answer the check. The step then updates and asks again, as it did before.

The site job, the release job and the deploy's build are missing nothing on today's image, so they no longer reach the mirror. A job that downloads packages still updates once first: the journeys on a cache miss, warm-browsers, or any job on a new image that lacks a library. The four tries of three minutes are unchanged. The comment on the site job's timeout in ci.yml now says the libraries come from the mirror only when the image lacks one.

The step's paths were tested with npx and apt-get stubbed: nothing missing, only fonts missing (with and without the fonts), other libraries missing, and no usable lists. Each made the expected apt calls. This pull request's own site job is the first run on a real runner image. npm run check, actionlint, zizmor and shellcheck pass.

Closes: #727