RUE-1585: Bound Valgrind installation

[steveklabnik]

Summary

• replace the unbounded inline Valgrind package install with a canonical bounded installer
• cap each apt operation at 10 minutes, acquisitions at 30 seconds, apt-native retries at two, and lock waits at 60 seconds
• terminate the installer process group on timeout or workflow cancellation while preserving failure status
• enforce the workflow wiring and exact policy through the CI contract, behavioral tests, and affected-target selection

Evidence

The linked job entered the installer immediately and remained there for 100 minutes until cancellation. A second occurrence retried Azure Ubuntu mirrors, fell back for release metadata, then stopped making progress for six hours while fetching package indexes. Normal installs take 10–22 seconds; one degraded but successful package download took 7m47s, which the 10-minute per-operation bound still accommodates.

Validation

• focused Buck CI-policy targets (3 passed)
• scripts/rue quick (30 passed)
• scripts/rue premerge (195 passed)
• Bash 3.2 and Python 3.9 baseline validators

Fixes RUE-1585