ci: fix Apptainer install by replacing flaky Launchpad PPA with direct GitHub release download

[Copilot]

add-apt-repository ppa:apptainer/ppa intermittently times out on GitHub-hosted runners, causing flaky CI failures unrelated to test code.

Changes

• Install method: Replace PPA-based install with a direct .deb download from Apptainer's GitHub releases (auto-detecting latest version via API), eliminating the Launchpad network dependency entirely
• Robustness: Add GITHUB_TOKEN auth on the version-detection API call (avoids 60 req/hr unauthenticated rate limit), explicit error check if version resolution fails, and .deb cleanup post-install
• Cache cleanup: Remove brittle caching of system dirs (/usr/bin/apptainer, /usr/lib/apptainer, /etc/apptainer) and the unused APT archives cache; retain only ~/.apptainer/cache
• graphviz: Extracted into its own step (was previously bundled inside the PPA install block)
• Action version: Bump actions/cache@v3 → actions/cache@v4

# Before
- name: Install Apptainer
  if: steps.cache-apptainer.outputs.cache-hit != 'true'
  run: |
    sudo apt-get install -y software-properties-common
    sudo add-apt-repository -y ppa:apptainer/ppa   # ← intermittent TimeoutError
    sudo apt-get update
    sudo apt-get install -y apptainer

# After
- name: Install Apptainer
  env:
    GH_TOKEN: ${{ github.token }}
  run: |
    APPTAINER_VERSION=$(curl -s -H "Authorization: ******" \
      https://api.github.com/repos/apptainer/apptainer/releases/latest \
      | grep '"tag_name"' | cut -d'"' -f4 | sed 's/v//')
    if [ -z "${APPTAINER_VERSION}" ]; then echo "ERROR: Could not determine Apptainer version" >&2; exit 1; fi
    wget -q "https://github.com/apptainer/apptainer/releases/download/v${APPTAINER_VERSION}/apptainer_${APPTAINER_VERSION}_amd64.deb"
    sudo apt-get install -y "./apptainer_${APPTAINER_VERSION}_amd64.deb"
    rm -f "./apptainer_${APPTAINER_VERSION}_amd64.deb"
    apptainer --version

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coveralls]

Coverage Report for CI Build 25229385145

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage remained the same at 77.528%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	89
Covered Lines:	69
Line Coverage:	77.53%
Coverage Strength:	0.78 hits per line

---

💛 - Coveralls