ci: bound the apt steps so a slow mirror cannot hang a run

[rmyndharis]

Install sqlite3 in the scripts-smoke job held two consecutive main runs open for over an hour each while every other job had already gone green, so neither run ever reported and main went without a signal. The step had no timeout, so a stalled apt-get would have burned the six-hour job default before failing.

What changed

• Both apt steps in ci.yml and release.yml carry timeout-minutes: 5 and skip the install when the runner image already ships the tool, which is the common case.
• The shellcheck step runs its own apt-get update rather than inheriting one from the step above, which no longer always runs.
• release.yml carries the same job and had the same two unbounded steps, so a release cut could have stalled the same way.

Impact

CI only. A failing install still fails the step: the short-circuit covers the tool already being present, nothing else.

Verification

• The three branches of the new command were exercised directly: tool present short-circuits at exit 0 without calling apt, tool absent takes the install branch, and tool absent with a failing install exits 1 rather than being swallowed.
• actionlint at the pinned version CI uses, both workflow files parse, job counts unchanged (9 and 14), and the docs/09 §9.6 job-table gate passes.