ci: bound the valgrind apt install with a hard timeout and retry

[kacy]

The memcheck step's apt-get preamble has stalled with zero output three times now (the runs for #811, #815, #819), each sitting until a step or job timeout. #817 added Acquire::*::Timeout options, but those only bound an HTTP read — the stalls in practice hang earlier (DNS, the dpkg lock, or sudo itself), so they slipped past.

This wraps each apt call in a hard timeout 240 and retries the pair once after a short sleep, so a wedge fails fast wherever it occurs and a transiently bad mirror gets a second chance instead of jamming the queue. The 30-minute step cap from #817 stays as the backstop.

what was tested

• YAML validated with a parser.
• The failure signature is documented from three runs whose logs end at make memcheck with no apt output; the local make memcheck on the same tree ran fully clean (all cases), confirming the wedge is the install preamble, not the suite. The retry/timeout wrapper is standard shell; this PR's own CI run exercises the changed step.