ci: bound the Verify proto syntax step so an apt stall fails fast

[dborup]

Relates to #156.

Problem

The Verify proto syntax step in Go Build & Test ran apt-get update / install with no timeout. A stalled mirror could hold the runner until the workflow-level limits kicked in (one PR run sat about 45 minutes in this step on 2026-09-30).

Change

Only .github/workflows/deploy.yml, 8 insertions and 2 deletions:

• timeout-minutes: 5 on the Verify proto syntax step.
• apt runs with -o Acquire::Retries=3 -o Acquire::http::Timeout=30 on both update and install, plus DEBIAN_FRONTEND=noninteractive.
• Explicit ::error:: and exit 1 if protoc is missing after the install.
• timeout-minutes: 40 on the go-test job.

The loop that runs protoc over every proto/*.proto is unchanged. Triggers, permissions, other jobs, concurrency and fork guards are untouched.

Job timeout rationale

Go Build & Test took 15.8 to 21.9 minutes (median about 20.7) over the last 12 completed runs. 40 minutes is roughly 1.8x the slowest observed run, so ordinary variance will not trip it, and it is far below the 6 hour GitHub default. The 5 minute step timeout is what actually bounds the apt hang. The proto step itself took 9 to 19 seconds in those runs.

Alternative considered

Download a pinned protoc release and check its sha256. That removes apt entirely and is cacheable, but it adds a version and checksum to maintain and a new download dependency. Bounded apt with retries plus a step timeout meets the acceptance criteria with the smallest diff, so I chose that.

Verification

• Workflow YAML parses (python3 yaml). actionlint is not installed locally.
• Fork guard count github.repository == 'Kpa-clawbot/CoreScope' is 9 before and after, and the diff of the guard lines is empty.
• The step's shell logic was run locally with the sudo apt-get lines removed: all proto/*.proto validate and exit is 0.
• A copy of proto/ with an invalid .proto added makes the step exit 1 with the protoc error.
• With protoc off PATH the step exits 1 with protoc not found after install.

Not verified

A real apt hang cannot be provoked in CI, so the fail-fast behaviour on a genuine stall is reasoned from the timeouts, not observed.

🤖 Generated with Claude Code