Make Linux release dependency installation deterministic

[IgorWarzocha]

Summary

• bypass GitHub runner mirror lists and third-party APT sources
• select Ubuntu canonical archives explicitly for x64 and ARM64
• force IPv4 and bound mirror retries and each APT command to three minutes
• retain the same Linux build dependency set

Why

Two release runs spent more than 20 minutes retrying the hosted runner's unhealthy Azure Ubuntu mirror. The build only needs Ubuntu archive packages, so unrelated runner mirrors should not be part of the release path.

Validation

• all six configured canonical Ubuntu pocket URLs return HTTP 200 over IPv4
• git diff --check
• release workflow run after merge is the end-to-end validation

[IgorWarzocha]

@codex please review this PR and give me 10-20 issues if any. Categorize findings as required, recommended, or optional.

[chatgpt-codex-connector]

💡 Codex Review

howcode/desktop/pi-threads/project-actions.ts

Line 208 in 6de9e7d

const cleanupResult = await deleteProjectPiFiles(projectId, projectSessionPaths)

Required: Delete project directories before session files

Required. In full-clean mode, the Pi session files are now unlinked before any project or worktree directory is removed. If a later rm fails—for example because of Windows file locking or insufficient permissions—the action throws while the project remains registered and present on disk, but its conversation files have already been irreversibly deleted. Preserve the previous failure-safe ordering by completing the directory removals before deleting the independently stored session history.

---

howcode/src/electron/main/headless/auth.ts

Lines 56 to 60 in 6de9e7d

	const trustedHosts = new Set([
	`127.0.0.1:${options.port}`,
	`localhost:${options.port}`,
	`${options.host}:${options.port}`,
	])

Recommended: Bracket IPv6 hosts before matching or formatting

Recommended. When headless mode is bound to the explicitly supported loopback host ::1, HTTP supplies a bracketed Host header such as [::1]:5173, but this set contains the unbracketed ::1:5173; because loopback disables the fallback, every browser request is rejected. The same unbracketed interpolation in getHeadlessAccessUrl produces the invalid URL http://::1:5173, so IPv6 loopback mode is unusable. Normalize IPv6 literals to bracketed URL-authority form consistently.

AGENTS.md reference: src/electron/main/headless/AGENTS.md:L4-L4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".