ci: retry npm ci once on the runner's intermittent SIGSEGV

The frontend deps step occasionally crashes with "Segmentation fault (core
dumped)" (exit 139) during `npm ci` — a memory/native flake on the act_runner,
unrelated to the change under test (it failed the deploy-fix PR whose only change
is the Dockerfile). Retry once with a clean node_modules before failing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci-deploy.yml

@@ -39,7 +39,12 @@ jobs:
         run: |
           node -v
           npm -v
-          npm ci --no-audit --no-fund
+          # npm ci occasionally segfaults on the runner (SIGSEGV/139, a memory/native
+          # flake). Retry once with a clean node_modules before failing the job.
+          npm ci --no-audit --no-fund \
+            || ( echo "npm ci failed ($?) — cleaning node_modules and retrying once..." \
+                 && rm -rf node_modules \
+                 && npm ci --no-audit --no-fund )
 
       - name: Test frontend
         working-directory: job-tracker-ui

JobTrackerApi/Dockerfile

@@ -9,7 +9,14 @@ COPY Models/ Models/
 COPY JobTrackerApi/ JobTrackerApi/
 COPY JobTrackerBackend/ JobTrackerBackend/
 
-RUN dotnet publish JobTrackerApi/JobTrackerApi.csproj -c Release -o /app/publish /p:UseAppHost=false
+# Retry once after clearing NuGet caches. Transient download corruption on the
+# build host can trip NU3008 ("package integrity check failed / has changed since
+# it was signed") while restoring a transitive package; clearing the caches and
+# re-downloading resolves it.
+RUN dotnet publish JobTrackerApi/JobTrackerApi.csproj -c Release -o /app/publish /p:UseAppHost=false \
+    || ( echo "Publish failed — clearing NuGet caches and retrying once..." \
+         && dotnet nuget locals all --clear \
+         && dotnet publish JobTrackerApi/JobTrackerApi.csproj -c Release -o /app/publish /p:UseAppHost=false )
 
 FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS runtime