azure-pipelines: wait for the dpkg lock when installing Linux deps

The 1ES Ubuntu agents come up with the `unattended-upgrades` service
already running, which holds `/var/lib/dpkg/lock-frontend` for the
first few minutes after boot. The Linux build's 'Install build
dependencies' and the Linux validate job's 'Install Git' steps both
ran `sudo apt-get update` immediately and intermittently failed
with

  E: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process <pid> (unattended-upgr)
  E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), is another process using it?

(see e.g. pipeline run #96 of debug-azp), aborting the entire job
on what is genuinely just a timing race.

Pass `-o DPkg::Lock::Timeout=600` to the affected `apt-get update`
and `apt-get install` invocations on both the build and validate
jobs. apt 2.1+ (Ubuntu 22.04 ships 2.4) honours this option by
internally polling for the lock rather than failing immediately,
which both turns the race into a backoff and lets us keep the
existing one-line apt invocations rather than wrapping them in an
ad-hoc retry loop. 600 seconds is enough headroom for the longest
boot-time unattended-upgrades run we have observed in CI without
giving up so late that a genuinely stuck lock would still block the
agent forever.

A short comment on the build-job step captures the rationale; the
validate-job comment cross-references it instead of duplicating the
explanation.

Assisted-by: Claude Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

.azure-pipelines/release.yml

@@ -918,8 +918,16 @@ extends:
                     targetType: inline
                     script: |
                       set -euo pipefail
-                      sudo apt-get update -q
-                      sudo apt-get install -y -q --no-install-recommends \
+                      # The 1ES Ubuntu agents come up with `unattended-
+                      # upgrades` running, which holds the dpkg
+                      # frontend lock for the first few minutes after
+                      # boot. `apt-get` releases earlier than 2.1
+                      # would have failed immediately with
+                      #   E: Could not get lock /var/lib/dpkg/lock-frontend
+                      # Pass `DPkg::Lock::Timeout=600` so apt waits up
+                      # to 10 minutes for the lock instead.
+                      sudo apt-get -o DPkg::Lock::Timeout=600 update -q
+                      sudo apt-get -o DPkg::Lock::Timeout=600 install -y -q --no-install-recommends \
                         build-essential \
                         tcl tk gettext asciidoc xmlto \
                         libcurl4-gnutls-dev libpcre2-dev zlib1g-dev libexpat-dev \
@@ -1151,8 +1159,11 @@ extends:
                       exit 1
                     fi
                     echo "Installing $deb"
-                    sudo apt-get update
-                    sudo apt-get install -y "$deb"
+                    # Wait up to 10 minutes for unattended-upgrades to
+                    # release the dpkg lock; see comment on the build
+                    # job's 'Install build dependencies' step.
+                    sudo apt-get -o DPkg::Lock::Timeout=600 update
+                    sudo apt-get -o DPkg::Lock::Timeout=600 install -y "$deb"
                   displayName: 'Install Git'
                 - bash: |
                     set -e