CI: Fix ARM64 apt-get dep11 metadata failures

Fix regression where apt update exits with code 100 due to dep11
(AppStream metadata) mirror sync failures, causing ARM64 CI builds
to fail even when core package indices are available.

Root Cause:
- Ubuntu mirrors occasionally have size mismatches for dep11 metadata
  during synchronization (e.g., Components-arm64.yml.gz files)
- apt update returns exit code 100 when ANY file fails to download
- Previous logic required APT_EXIT == 0 AND no critical failures
- This meant dep11 failures (non-critical) caused retries and eventual
  failure after 3 attempts

Issue Example:
  E: Failed to fetch .../dep11/Components-arm64.yml.gz
     File has unexpected size (3692 != 3697). Mirror sync in progress?
  E: Some index files failed to download. They have been ignored, or
     old ones used instead.
  Error: The process failed with exit code 100

Fix Strategy:
- Check ONLY for critical package index failures (Packages/Sources/
  Release/InRelease), not exit code
- dep11 metadata failures are non-critical (GUI application metadata)
- Core build tools (make, git, curl, clang, bc) don't require dep11
- If core indices available, proceed regardless of dep11 status

Author: jserv

.github/workflows/main.yml

@@ -343,39 +343,88 @@ jobs:
         # No 'sudo' is available
         install: |
           # Retry apt update with exponential backoff for mirror sync issues
-          # Note: dep11 (AppStream metadata) failures are non-critical for build tools
+          # dep11 = AppStream metadata (GUI app discovery, non-critical for CLI builds)
+          # Critical files: Packages, Sources, Release, InRelease (binary/source indices)
           set -o pipefail
+          APT_SUCCESS=0
           for i in 1 2 3; do
+            echo "=== apt update attempt $i/3 ==="
             if apt update -qq --allow-releaseinfo-change 2>&1 | tee /tmp/apt-update.log; then
               APT_EXIT=0
             else
               APT_EXIT=$?
             fi
-            # Check for critical failures (package indices), ignore dep11 metadata
-            # Include InRelease which is the combined Release+Release.gpg file
-            if [ $APT_EXIT -eq 0 ] && ! grep -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log; then
-              echo "apt update succeeded (core package lists available)"
-              break
+
+            # Check if log file was created
+            if [ ! -f /tmp/apt-update.log ]; then
+              echo "ERROR: apt update log file not created"
+              if [ $i -lt 3 ]; then
+                sleep $((i * 30))
+                continue
+              else
+                exit 1
+              fi
             fi
-            if [ $i -lt 3 ]; then
-              delay=$((i * 30))
-              echo "apt update attempt $i: errors detected (exit=$APT_EXIT), waiting ${delay}s..."
-              sleep $delay
+
+            # Check for critical package index failures (ignore dep11 metadata)
+            # dep11 files like Components-arm64.yml.gz are non-critical (AppStream metadata)
+            # Core package indices (Packages/Sources/Release/InRelease) MUST succeed
+            if grep -q -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log; then
+              # Critical failure detected
+              echo "ERROR: Critical package index files failed to download"
+              grep -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log | head -5
+              if [ $i -lt 3 ]; then
+                delay=$((i * 30))
+                echo "Retrying in ${delay}s... (attempt $((i + 1))/3)"
+                sleep $delay
+              else
+                echo "FATAL: Core package indices unavailable after 3 attempts"
+                cat /tmp/apt-update.log
+                exit 1
+              fi
             else
-              echo "Warning: Proceeding after 3 attempts - some package lists may be incomplete"
+              # Success: core package indices available (dep11 failures OK)
+              APT_SUCCESS=1
+              if [ $APT_EXIT -eq 0 ]; then
+                echo "✓ apt update succeeded (all package lists available)"
+              else
+                echo "✓ apt update completed with warnings (exit=$APT_EXIT)"
+                echo "  Core package indices: AVAILABLE"
+                if grep -q "dep11" /tmp/apt-update.log; then
+                  echo "  dep11 metadata: INCOMPLETE (non-critical, GUI app metadata)"
+                fi
+              fi
+              break
             fi
           done
-          # Install packages - exit 0 even if dep11 metadata is incomplete
+
+          # Verify we succeeded in at least one attempt
+          if [ $APT_SUCCESS -ne 1 ]; then
+            echo "FATAL: apt update failed after all retry attempts"
+            exit 1
+          fi
+
+          # Install packages (exit 0 even if dep11 metadata is incomplete)
+          echo "=== Installing build dependencies ==="
           apt install -yqq make git curl wget clang libsdl2-dev libsdl2-mixer-dev lsb-release software-properties-common gnupg bc 2>&1 | tee /tmp/apt-install.log || true
-          # Verify critical packages were installed
+
+          # Verify critical packages were installed successfully
+          echo "=== Verifying critical build tools ==="
+          MISSING_PKGS=""
           for pkg in make git curl clang bc; do
             if ! command -v $pkg >/dev/null 2>&1; then
-              echo "ERROR: Critical package $pkg failed to install!"
-              cat /tmp/apt-install.log
-              exit 1
+              MISSING_PKGS="$MISSING_PKGS $pkg"
             fi
           done
-          echo "All critical build tools installed successfully"
+
+          if [ -n "$MISSING_PKGS" ]; then
+            echo "ERROR: Critical packages failed to install:$MISSING_PKGS"
+            echo "=== apt install log ==="
+            cat /tmp/apt-install.log
+            exit 1
+          fi
+
+          echo "✓ All critical build tools installed successfully"
         # FIXME: gcc build fails on Aarch64/Linux hosts
         env: |
           CC: clang-18