Two more sources of CI noise/fragility alongside the debconf frontend fix: fish's install pulls in man-db/groff-base/xsel as recommends, triggering a slow mandb rebuild for tooling nothing here uses; --no-install-recommends skips that. apt-get update had no retry policy, so a transient blip against the PPA mirror failed the whole job; -o Acquire::Retries=3 gives it a few chances first.