ci: install tmux and zip tooling on the Linux test lane, and pin it

.github/workflows/ci.yml

@@ -444,6 +444,55 @@ jobs:
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && steps.ci_profile.outputs.ci_profile == 'full' }}"
         run: 'node --test ${{ env.HELPER_TESTS }}'
 
+      # The install-script packaging suite needs zip/unzip, and throws on a
+      # CI host that ships neither, so a silent skip there is impossible.
+      # tmux is PRE-LANDED for #8388: that PR's capture-tui carries a
+      # describe.skipIf(!hasTmux)-gated real-tmux suite which, on a runner
+      # without tmux (the hosted ubuntu-latest image ships none), would
+      # silently skip every real-tmux behaviour — holder survival, matching,
+      # server reaping, refusal contracts — inside a green required check.
+      # Until it lands, the tmux half installs a tool nothing here uses;
+      # that is deliberate, so the tooling is in place before the suite that
+      # depends on it (qwen-autofix.yml already installs tmux the same way).
+      - name: 'Install tmux and zip tooling'
+        if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && steps.ci_profile.outputs.ci_profile == 'full' && runner.os == 'Linux' }}"
+        # Bounded AND advisory: a stalled mirror or dpkg lock must neither
+        # hang the job toward its 60-minute cap nor red the required check —
+        # continue-on-error absorbs the step-level timeout. The apt calls
+        # carry their OWN shorter bound (140 s + 140 s = 280 s < the 300 s
+        # step cap) so the guard below still runs: when the step-level
+        # timeout fires there is no `|| echo`, and the lane loses its
+        # tooling with no annotation to say so.
+        timeout-minutes: 5
+        continue-on-error: true
+        run: |-
+          if command -v tmux > /dev/null 2>&1 && command -v zip > /dev/null 2>&1 && command -v unzip > /dev/null 2>&1; then
+            # Advisory here too: a broken-but-installed tmux (dangling
+            # symlink, missing lib) must not fail the required Test check
+            # before a single test has run.
+            tmux -V || echo '::warning::tmux present but not answering; real-tmux capture tests will be skipped.'
+            zip -v > /dev/null 2>&1 || echo '::warning::zip present but not answering; the zip-packaging suite will throw on CI.'
+            unzip -v > /dev/null 2>&1 || echo '::warning::unzip present but not answering; the zip-packaging suite will throw on CI.'
+          elif [ "$(id -u)" = '0' ] && command -v apt-get > /dev/null 2>&1; then
+            # Root-container lanes have no sudo (and need none): apt-get
+            # runs as-is. Advisory, not a gate: an apt hiccup must not red
+            # this step before a single test has run — the suites carry
+            # their own signal (the real-tmux suite skips; the zip suite
+            # throws on CI). ::warning:: (not a plain echo) so a lane
+            # where the install PERMANENTLY fails shows the loss in the
+            # check UI instead of hiding it in a multi-thousand-line log.
+            timeout 140 apt-get update -qq && timeout 140 apt-get install -y -qq --no-install-recommends tmux zip unzip \
+              || echo '::warning::tmux/zip install failed; real-tmux capture tests will be skipped and the zip-packaging suite will throw on CI.'
+          elif sudo -n true > /dev/null 2>&1 && command -v apt-get > /dev/null 2>&1; then
+            # Same advisory contract as the root branch; sudo -n here so a
+            # runner without passwordless sudo fails fast instead of
+            # hanging on a password prompt toward the step's bound.
+            timeout 140 sudo -n apt-get update -qq && timeout 140 sudo -n apt-get install -y -qq --no-install-recommends tmux zip unzip \
+              || echo '::warning::tmux/zip install failed; real-tmux capture tests will be skipped and the zip-packaging suite will throw on CI.'
+          else
+            echo '::warning::tmux/zip unavailable; real-tmux capture tests will be skipped and the zip-packaging suite will throw on CI.'
+          fi
+
       - name: 'Run tests and generate reports'
         id: 'unit_tests'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && steps.ci_profile.outputs.ci_profile == 'full' }}"