ci: Update mkcert installation and add stuck job timeouts - #5812

Every job in the repo runs .github/actions/init, which apt-installed mkcert
and libnss3-tools. That made Ubuntu's mirrors a hard dependency of all of
CI, and apt retries a degraded mirror with long internal timeouts, so an
upstream archive outage hangs jobs rather than failing them. During one such
outage half a Host run's shards sat in `init` for up to 47 minutes without
advancing while the other half completed normally.

The install was also nearly redundant: libnss3-tools is already present on
the runner image, so only mkcert was genuinely being fetched — a single Go
binary that mise can supply from its own cached tool store. Declaring it in
[tools] removes the apt call from init entirely, which covers every workflow
that provisions the dev cert, since all of them go through init.

The D-Bus helpers do install packages the image lacks, so that step keeps
apt but gains bounded retries and a step timeout.

Neither host-test nor live-test set timeout-minutes, so a stuck shard
inherited GitHub's 360-minute default and held a runner for six hours. That
starves the pool rather than merely wasting minutes: during the same outage
a concurrent run had twelve shards queued for capacity. Healthy shards have
never exceeded ~19 minutes (median 13, p99 19 across 107 successful jobs),
and live-test ~10, so the new ceilings leave ample headroom while bounding a
wedge to minutes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>