Harden Linux SDK dependency setup

[Richie Gomez (richiemsft)]

📖 Description

Keep the cached Bubblewrap/LXC installation as the fast path while preventing stale Ubuntu package metadata from producing a green setup step with no packages installed.

• Refresh apt indexes before the cache action resolves package versions.
• Bump the cache namespace to avoid reusing the empty cache saved by the failed run.
• Verify all requested packages plus bwrap and lxc-start after restoration.
• Retry a direct apt installation up to three times when the cached action is incomplete.
• Fail immediately when LXC profiles or services cannot be activated.

🔗 References

Observed in https://github.com/microsoft/mxc/actions/runs/31195213220/job/92925641972

🔍 Validation

• Parsed SDK.Integration.Test.Job.yml as YAML.
• Checked the repair script with bash -n.
• Ran git diff --check.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Richie Gomez (richiemsft)]

hey Soham Das (@SohamDas2021) I've been getting some flaky results from the linux validation step, sometimes there is a 404 in the logs. adding retries to the job.

[Copilot]

Pull request overview

Hardens Linux SDK integration dependency setup against stale APT metadata and incomplete cache restoration.

Changes:

• Refreshes APT indexes and bumps the cache namespace.
• Adds dependency verification, repair retries, and strict LXC service checks.
• One issue remains: dpkg-query forces repair on every cache hit.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

.github/workflows/SDK.Integration.Test.Job.yml:142

• The retry loop does not cover index-refresh failures: because set -e is active and apt-get update is outside the if, any transient update error exits the step on the first attempt instead of reaching attempts 2 and 3. Include the refresh in the conditional so the whole repair operation is retried as intended.

            for attempt in 1 2 3; do
              sudo apt-get -o Acquire::Retries=3 update
              if sudo env DEBIAN_FRONTEND=noninteractive \
                apt-get -o Acquire::Retries=3 install -y "${packages[@]}"; then

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Branden Bonaby (bbonaby)]

Thanks Richie! This should unblock the other PRs in the queue