ci: retry transient dependency installs + skip native rebuild in typecheck

[OutThisLife]

Stacked on #49272 (base = bb/ci-affected-only). GitHub will auto-retarget this to main once that merges. Review/merge #49272 first.

Problem

The most common "red, re-run, green" CI failures here aren't test bugs — they're transient network/toolchain flakes during dependency install. The reported case: the typecheck (ui-tui) job died in npm ci while node-gyp rebuilt node-pty's native binary and choked fetching Node headers (an undici assert(!this.paused)). It never reached tsc.

Fix

1. Auto-retry every PR-path network install — a reusable .github/actions/retry composite action wraps a command and retries on non-zero exit (3× / 10s). The command is passed via env (never interpolated into the script body) so it can't break or inject. Applied to:

Step	Workflow
npm ci	typecheck, desktop-build, docs-site
uv sync	tests, e2e
uv tool install ruff/ty	lint
pip install	docs-site

ripgrep download switched to curl --retry 3 --retry-delay 5 (curl-native retry).

2. Root-cause the typecheck flake — typecheck now runs npm ci --ignore-scripts. tsc only needs TS sources + type defs, not compiled native binaries, so skipping install scripts removes the node-pty rebuild entirely (eliminating the header-fetch flake) and is faster. desktop-build keeps scripts (its production build may need the native binary) and relies on retry.

Validation

• npm ci --ignore-scripts + tsc passes for ui-tui, apps/shared, apps/desktop (~17s, no native build).
• retry loop semantics unit-checked: succeeds first try, succeeds on the Nth retry, gives up non-zero after N.
• all five touched YAML files parse.

Out of scope (deliberate)

• docker-publish (uv pip install) is main-only after ci: run only the lanes a PR affects + build Docker on main only #49272, lower flake exposure — follow-up.
• build-windows-installer / upload_to_pypi / deploy-site npm ci — release/dispatch flows, low frequency — follow-up.

[alt-glitch]

Related: #49227 (closed) — this PR supersedes that earlier "skip native rebuild in typecheck" attempt and broadens it into a reusable .github/actions/retry composite covering npm ci / uv sync / uv tool install across the lint, tests, docs-site, and typecheck workflows. Valid resubmission of the closed predecessor, not a duplicate.

[teknium1]

Clean, well-scoped CI hardening. Approving.

Security: the composite action passes the command through env._CMD and runs bash -c "$_CMD" rather than interpolating it into the script body, so a command with quotes/specials can't break or inject into the runner. Correct pattern.

set -uo pipefail without -e is right here — the loop captures the command's exit code manually via the if bash -c, and -e would abort the retry on the first failed attempt.

--ignore-scripts on typecheck: sound. tsc only needs TS sources + type defs, so dropping the node-pty node-gyp rebuild removes the actual flake source rather than just papering over it with retry — and it's faster. Keeping scripts on desktop-build (its production build may need the native binary) + relying on retry there is the right split.

Two notes, neither blocking:

1. Stacked on #49272 (base = bb/ci-affected-only) — merge that first, then this auto-retargets to main.
2. Because #49272 makes CI affected-only and this PR only touches .github/ workflow files, the touched lanes (typecheck/lint/tests) didn't actually run here — only the four always-on guard jobs are green. The npm ci --ignore-scripts + tsc path was validated locally per the PR body; first real CI exercise lands on the next frontend/python PR after merge.

LGTM.