[jserv]

Across 39 recent check runs, the slow tail was environment setup rather than tests. Install Chromium had a p90 of 560 to 620s (max 808s) because --with-deps runs apt-get update and an install every time, and on ubuntu-24.04 it installed only fonts and upgrades. The apt steps had a p90 around 185s for packages that are partly already on the image. Restoring the cargo cache was a steady 30s, but its key hashed check.yml, which changed 35 times in 60 days against 23 Cargo.lock changes, and every change saved a fresh 1.6 GB entry.

A new apt-install action installs only the packages dpkg does not report as installed, tries the image's package lists before an update, and bounds each apt call. The Chromium action installs only the headless shell (every launch in the repo is headless), runs install-deps only when ldd finds a missing library in the shell or its bundled .so files, fails if no shell is found, and requires a launch check. Its cache key follows playwright-core/browsers.json instead of the whole lockfile. The cargo cache key now hashes rustc, the C++ compiler's own --version banner, and the build-flag variables, and fails the step when CXX does not run instead of silently hashing less.

Verified locally: ./scripts/test.sh portable passes, actionlint and shellcheck on each action's script are clean, and the new tests in tests/test_test_gate.py cover the apt selection and retry, the Chromium dependency branch, the cache key inputs, and a guard that no browser launch is headed or names a channel. Each new test was checked to fail when the logic it covers is removed. Not yet verified on a hosted runner: whether the browser suites behave the same without the fonts --with-deps used to install. This PR's browser lane is that check.

Left out: splitting the browser lane (243s of tests, no timeouts, so the gain is about two minutes for another runner's setup) and a prebuilt CI image, which is worth measuring only if apt remains a bottleneck after this. The first runs on this branch start cold, because both cache keys changed.

---

Summary by cubic

Skips CI setup work the runner already has, cutting the slow tail of check runs that was environment setup rather than tests. First runs start cold because both cache keys changed.

• The new apt-install action installs only packages dpkg does not report as installed, trying the image's package lists before an update.
• The Chromium action installs just the headless shell and runs install-deps only when ldd finds a missing library; it fails when no shell is found and requires a launch check. A test guard refuses headed or channel launches and now accepts an explicit headless: true.
• The cargo cache key now hashes the compilers and build flags instead of check.yml, which rotated a 1.6 GB entry on every workflow edit.
• Verified locally only; this PR's browser lane is the check on a hosted runner.

^{Written for commit 2866d10. Summary will update on new commits.}

[ColtenOuO]

LGTM, maybe we can squash the commit 3fec2ff