ci: cut per-shard setup time in the pytest matrix (#6557)

Each of the four pytest shards spends ~84 s on setup before pytest
starts, and repeats all of it: pip resolves and installs ~108 packages
(~24 s, even with the pip cache hit), Playwright downloads Chromium and
the headless shell with no cache (~11 s), and three separate
apt-get update calls run.

- Install requirements with uv (astral-sh/setup-uv, pinned) and cache
  its downloads keyed on requirements.txt. uv resolves the same 108
  pins as pip for this requirements.txt.
- Cache ~/.cache/ms-playwright keyed on package-lock.json so a hit
  skips the browser downloads; --with-deps still installs system libs.
- Install FFmpeg and bubblewrap in one apt pass. The containment step
  keeps its bwrap probes unchanged.
- Add --durations=25 so the slowest tests per shard are visible; the
  shard planner only weights the slow marker, and shard times vary
  from 154 s to 296 s within one run.

.github/workflows/ci.yml

@@ -147,8 +147,15 @@ jobs:
         if: steps.docs-check.outputs.docs_only != 'true'
         with:
           python-version: "3.11"
-          cache: pip
-      - run: pip install -r requirements.txt
+      # uv resolves the same versions as pip but installs ~5x faster, and its
+      # cache keeps each shard from re-downloading the whole requirement set.
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        if: steps.docs-check.outputs.docs_only != 'true'
+        with:
+          enable-cache: true
+          cache-dependency-glob: requirements.txt
+          prune-cache: false
+      - run: uv pip install --system -r requirements.txt
         if: steps.docs-check.outputs.docs_only != 'true'
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         if: steps.docs-check.outputs.docs_only != 'true'
@@ -157,15 +164,25 @@ jobs:
           cache: npm
       - run: npm ci
         if: steps.docs-check.outputs.docs_only != 'true'
+      # Browser binaries are keyed on the lockfile's Playwright version. On a
+      # hit, --with-deps still installs the system libraries but skips the
+      # browser downloads.
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        if: steps.docs-check.outputs.docs_only != 'true'
+        with:
+          path: ~/.cache/ms-playwright
+          key: ms-playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
       - run: npx playwright install --with-deps chromium
         if: steps.docs-check.outputs.docs_only != 'true'
       - run: mkdir -p data  # sqlite DB lives at ./data/app.db
         if: steps.docs-check.outputs.docs_only != 'true'
-      - name: Install FFmpeg for media integration tests
+      # One apt pass for FFmpeg (media integration tests) and bubblewrap
+      # (containment, verified in the next step).
+      - name: Install FFmpeg and bubblewrap
         if: steps.docs-check.outputs.docs_only != 'true'
         run: |
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ffmpeg
+          sudo apt-get install -y --no-install-recommends ffmpeg bubblewrap
           command -v ffmpeg
           ffmpeg -version | head -n 1
 
@@ -174,8 +191,6 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends bubblewrap
           bwrap --version
           sysctl kernel.unprivileged_userns_clone user.max_user_namespaces \
             kernel.apparmor_restrict_unprivileged_userns
@@ -223,4 +238,4 @@ jobs:
         if: steps.docs-check.outputs.docs_only != 'true'
         env:
           PYTEST_SHARD: ${{ matrix.shard }}
-        run: python -m pytest -q -rs --shard "$PYTEST_SHARD"
+        run: python -m pytest -q -rs --durations=25 --shard "$PYTEST_SHARD"