Retry and shrink the apk-tools fetch in the OpenWrt package workflow

The .apk jobs build apk-tools v3 from source, and did it with a bare full
clone of gitlab.alpinelinux.org with no retry. That host took down the
whole OpenWrt Package run on master 5896021 twice in a row: attempt 1
died on both architectures with "fatal: early EOF / fetch-pack: invalid
index-pack output", attempt 2 on aarch64 with a connect timeout after
135 seconds. Nothing in our tree was at fault either time, and every
branch's .apk job carries the same single point of failure.

Fetch only the pinned commit at depth 1 and retry it three times with a
backoff, falling back to the old full clone once. The by-SHA fetch needs
uploadpack.allowReachableSHA1InWant, which the server allows today; the
fallback covers that policy changing. Exhausting every attempt now fails
with an ::error:: naming the commit and the repo rather than a bare git
exit code.

.github/workflows/package-openwrt.yml

@@ -718,9 +718,35 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             git ca-certificates build-essential meson ninja-build pkg-config \
             zlib1g-dev libssl-dev libzstd-dev liblzma-dev lua5.4-dev scdoc
-          git clone --quiet https://gitlab.alpinelinux.org/alpine/apk-tools.git /tmp/apk-tools
+          # The upstream host has failed this step twice in one run (early EOF,
+          # then a connect timeout), so fetch only the pinned commit and retry.
+          # The by-SHA fetch needs uploadpack.allowReachableSHA1InWant, which
+          # the server has today; the full clone stays as the fallback in case
+          # that policy changes.
+          APK_TOOLS_REPO=https://gitlab.alpinelinux.org/alpine/apk-tools.git
+          fetch_pinned() {
+            rm -rf /tmp/apk-tools
+            git init --quiet /tmp/apk-tools \
+              && git -C /tmp/apk-tools remote add origin "$APK_TOOLS_REPO" \
+              && git -C /tmp/apk-tools fetch --quiet --depth 1 origin "${APK_TOOLS_COMMIT}" \
+              && git -C /tmp/apk-tools checkout --quiet FETCH_HEAD
+          }
+          clone_full() {
+            rm -rf /tmp/apk-tools
+            git clone --quiet "$APK_TOOLS_REPO" /tmp/apk-tools \
+              && git -C /tmp/apk-tools checkout --quiet "${APK_TOOLS_COMMIT}"
+          }
+          got_source=
+          for method in fetch_pinned fetch_pinned fetch_pinned clone_full; do
+            if "$method"; then got_source=$method; break; fi
+            echo "apk-tools $method failed; retrying after backoff" >&2
+            sleep 20
+          done
+          if [ -z "$got_source" ]; then
+            echo "::error::could not obtain apk-tools ${APK_TOOLS_COMMIT} from $APK_TOOLS_REPO"
+            exit 1
+          fi
           cd /tmp/apk-tools
-          git checkout --quiet "${APK_TOOLS_COMMIT}"
           meson setup build
           ninja -C build src/apk
           APK_BIN=/tmp/apk-tools/build/src/apk