[CI] Harden ARM64 package access and Docker disk usage

[neverhook]

Summary

• switch Ubuntu Ports entries from HTTP to HTTPS before the ARM64 CUDA install
• force IPv4 and add apt retry/timeout options
• make the NVIDIA keyring download use IPv4 with bounded retries
• free hosted-runner disk before the source Docker build and report disk usage before/after
• make the Docker build's existing Release configuration explicit and enable plain progress logs

Motivation

ARM64 package access

The ARM64 matrix fails before Mooncake is configured or built. In PR #2934 run 29479306961, Python 3.10 failed in Install CUDA Toolkit 13.0 (arm64 SBSA) and Python 3.12 was cancelled by matrix fail-fast. PR #2935 reproduced the same failure in run 29479320966. The completed logs show IPv6 is unreachable and all IPv4 connections to ports.ubuntu.com:80 time out while fetching Ubuntu packages.

Docker build capacity

PR #2934 run 29479306961 also failed while linking inside docker/mooncake.Dockerfile with /tmp ... No space left on device; pip then reported [Errno 28]. The same Docker job passed on the larger stacked #2935 old SHA, so this is hosted-runner capacity pressure rather than a source error. The cleanup removes large unused hosted-toolcache directories before Buildx starts and leaves disk diagnostics in every run.

This PR is intentionally separate from #2934 and #2935 because both failures are runner/CI reliability issues, not their feature code.

Validation

Local checks:

• parsed .github/workflows/ci.yml with PyYAML
• extracted the modified ARM64 and Docker run blocks and passed them through bash -n
• git diff --check
• typos-cli 1.30.2 .github/workflows/ci.yml

Remote ARM64 validation on commit 140d8e76 in run 29480368390:

• build-arm64 (3.10): success, including CUDA installation, project build, wheel build, and artifact upload
• build-arm64 (3.12): success, including CUDA installation, project build, wheel build, and artifact upload

A new full Actions run on head a06a81df will validate the added Docker cleanup and reconfirm ARM64.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[neverhook]

Superseded by #2951. The follow-up Docker disk hardening was pushed after the initial opened-event run, and this fork token cannot add the required run-ci label for synchronize events. #2951 carries the same commits and was opened fresh to trigger a complete validation run.