ci: run apt-get update before installing Linux packages

[oc-tmueller]

Description

Every API Smoke Tests / Acceptance tests job was failing on the Install Linux packages step, and
re-running did not help — run 35783629819, job 107115884062:

E: Failed to fetch mirror+file:/etc/apt/apt-mirrors.txt/pool/main/g/ghostscript/libgs-common_10.02.1%7edfsg1-0ubuntu7.8_all.deb  404  Not Found [IP: 52.147.219.192 80]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

The step installed straight from the package index baked into the runner image
(ubuntu24/20260907.300). That index is stale, so the exact .deb versions it names have already
been superseded on the Azure mirror and the URLs 404. imagemagick — the one value any caller passes
for additional-packages — pulls in ghostscript, so a ghostscript security update is enough to take
down every acceptance job with no change on our side. This is the long-standing runner-images problem
in actions/runner-images#7452, and its documented workaround is to always apt-get update first.

Changes

• apt-get update immediately before each install. Install Apache already did this; Install Linux packages and the libxml2-utils step did not.
• -o Acquire::Retries=3 on the installs, so one flaky mirror hit retries rather than taking a whole
  matrix job down with it.
• apt-get instead of apt for libxml2-utils — apt has no stable CLI for scripts and prints a
  warning saying so on every run.

Only .github/workflows/acceptance.yml is touched. php-unit.yml and js-unit.yml already update
before installing. The 10.16 branch has no acceptance.yml, and its only apt call
(php-unit.yml) already updates, so there is nothing to backport.

Related

Unblocks #41827, which was red purely on this and does not touch .github/ at all.

How to test

CI is the test — the acceptance jobs on this PR run the same
ci.yml → acceptance.yml path with additional-packages: 'imagemagick'. The Install Linux packages step should now show apt-get update fetching indexes followed by a clean
Setting up ghostscript / Setting up imagemagick, with no 404 Not Found.

🤖 Generated with Claude Code

[oc-tmueller]

@phil-davis @jvillafanez

[phil-davis]

Note: 10.16 has no acceptance.yml workflow, so there is nothing to backport.