ci: 'Verify proto syntax' can hang in apt-get with no timeout

[dborup]

Summary

The "Verify proto syntax" step in the Go Build & Test job can hang for a long time. On 2026-09-30 a PR run (36728235996, attempt 1) sat about 45 minutes in this step after every Go test step had already passed; a rerun went through the step in seconds. The step and its job have no timeout of their own, so a hang holds the runner until the workflow-level limits kick in.

Where (master be35eefb)

.github/workflows/deploy.yml, around lines 251–260:

- name: Verify proto syntax
  run: |
    set -e
    sudo apt-get update -qq
    sudo apt-get install -y protobuf-compiler
    ...

apt-get update / install against the runner's mirrors is the likely place it stalled (network or mirror lock).

Proposed fix

Keep the check, make a stall fail fast instead of hanging:

• add timeout-minutes: 5 to the step (and consider one on the job);
• give apt network timeouts and retries, e.g. -o Acquire::Retries=3 -o Acquire::http::Timeout=30, or avoid apt entirely by downloading a pinned protoc release with a checksum (cacheable).

Do not change triggers, permissions, jobs or the fork guards (github.repository == 'Kpa-clawbot/CoreScope').

Acceptance criteria

• A stalled apt/download in this step fails within a few minutes with a clear message instead of hanging.
• The step still validates every proto/*.proto.
• Fork-guard lines unchanged.

[dborup]

Fixed by #168 (merged as 84c637ea). "Verify proto syntax" now has timeout-minutes: 5, apt runs with Acquire::Retries=3 and Acquire::http::Timeout=30 (non-interactive), and the step fails clearly if protoc is missing. The "Go Build & Test" job has timeout-minutes: 40; recent master runs take 15–21.5 min. Leftover: a real apt stall could not be reproduced in CI, so fail-fast is configured but not observed.