ci(lx-release): retry Debian-dependent musl toolchain steps (flaky snapshot.debian.org)

rc.22 linux-musl jobs failed on 'get-clang.sh: 503 No healthy backends' from
snapshot.debian.org (transient mirror outage). get-clang.sh retries internally
but back-to-back, so a whole outage window fails all attempts. Wrap the two
Debian-fetching steps with an external retry + growing backoff:
- Download Chromium musl toolchain: 5 attempts, 30→60→120→240s
- Regenerate Debian keyring: 4 attempts, 20→40→80s

Conservative: publish still needs all builds (a real musl breakage still blocks
the release, only transient mirror flakes are ridden out). No code change.

.github/workflows/lx-release.yml

@@ -183,7 +183,17 @@ jobs:
           set -xeuo pipefail
           rm -f ~/cronet-go/naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
           cd ~/cronet-go
-          GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
+          # generate_keyring.sh fetches Debian archive keys from keyservers,
+          # which can also be flaky — retry with backoff. (lx CI)
+          n=0; max=4; delay=20
+          until GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh; do
+            n=$((n+1))
+            if [ "$n" -ge "$max" ]; then
+              echo "keyring regen failed after $max attempts"; exit 1
+            fi
+            echo "keyring regen attempt $n failed; retrying in ${delay}s"
+            sleep "$delay"; delay=$((delay*2))
+          done
 
       - name: Cache Chromium toolchain
         uses: actions/cache@v4
@@ -199,7 +209,20 @@ jobs:
         run: |
           set -xeuo pipefail
           cd ~/cronet-go
-          go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl download-toolchain
+          # The toolchain download pulls sysroot .deb packages from
+          # snapshot.debian.org, which intermittently 503s ("No healthy
+          # backends"). get-clang.sh already retries internally but back-to-back,
+          # so a whole outage window fails all attempts. Retry the step with a
+          # growing backoff to ride out a transient mirror outage. (lx CI)
+          n=0; max=5; delay=30
+          until go run ./cmd/build-naive --target=linux/${{ matrix.arch }} --libc=musl download-toolchain; do
+            n=$((n+1))
+            if [ "$n" -ge "$max" ]; then
+              echo "toolchain download failed after $max attempts"; exit 1
+            fi
+            echo "toolchain download attempt $n failed; retrying in ${delay}s (snapshot.debian.org may be flaky)"
+            sleep "$delay"; delay=$((delay*2))
+          done
 
       - name: Set Chromium toolchain environment
         run: |