ci: retry the mdPress PDF build instead of failing the job on a Chrome flake

The mdPress PDF step drives headless Chrome, which intermittently dies with
"websocket url timeout reached" plus dbus/bus.cc:405 errors. Confirmed by the
verbatim signature in six runs across five repos on 2026-07-22 and 07-23 — most
recently it failed a docker_practice smoke test after mdPress had already
finished parsing 196 chapters and assembling the HTML, dying only at step 5/5.
It is infrastructure, not content: a rerun clears it every time.

oc_guide already solved this with tools/build_pdf.py (bounded retries, process-
scoped timeout cleanup, per-attempt logs) and is notably absent from the flake
victims. This applies the same idea to the other 13 repos with a much smaller
change: shadow mdpress with a retry function once per run block, so every call
shape — including the multi-line continuations — is covered without rewriting
42 heterogeneous call sites. `command mdpress` reaches the real binary.

Fails closed: after 3 attempts the function returns 1 and errexit fails the
step. Verified all three paths against a fake mdpress before rollout — first-try
success, success after two flakes, and 3x failure aborting the step without
printing the following command.

oc_guide is untouched (it has no `mdpress build` call). Converging the other 13
onto its richer build_pdf.py remains the better long-term shape.

.github/workflows/auto-release.yml

@@ -98,6 +98,10 @@ jobs:
           SAFE_TAG_NAME: ${{ steps.tag.outputs.SAFE_TAG_NAME }}
         working-directory: ${{ runner.temp }}/docker_practice-pdf-src
         run: |
+          # mdPress PDF generation drives headless Chrome, which intermittently dies with
+          # "websocket url timeout reached" + dbus errors. Retry the build, not the whole job.
+          mdpress() { local a; for a in 1 2 3; do command mdpress "$@" && return 0;
+            echo "::warning::mdpress attempt $a failed; retrying in 10s"; sleep 10; done; return 1; }
           mkdir -p "$GITHUB_WORKSPACE/dist"
           mdpress build --format pdf \
             --output "$GITHUB_WORKSPACE/dist/docker_practice-${SAFE_TAG_NAME}.pdf"

.github/workflows/ci.yaml

@@ -93,6 +93,10 @@ jobs:
       - name: Build PDF
         working-directory: ${{ runner.temp }}/docker_practice-pdf-src
         run: |
+          # mdPress PDF generation drives headless Chrome, which intermittently dies with
+          # "websocket url timeout reached" + dbus errors. Retry the build, not the whole job.
+          mdpress() { local a; for a in 1 2 3; do command mdpress "$@" && return 0;
+            echo "::warning::mdpress attempt $a failed; retrying in 10s"; sleep 10; done; return 1; }
           mkdir -p "$GITHUB_WORKSPACE/dist"
           mdpress build --format pdf --output "$GITHUB_WORKSPACE/dist/docker_practice.pdf"
 

.github/workflows/preview-pdf.yml

@@ -72,6 +72,10 @@ jobs:
       - name: Build latest preview PDF
         working-directory: ${{ runner.temp }}/docker_practice-pdf-src
         run: |
+          # mdPress PDF generation drives headless Chrome, which intermittently dies with
+          # "websocket url timeout reached" + dbus errors. Retry the build, not the whole job.
+          mdpress() { local a; for a in 1 2 3; do command mdpress "$@" && return 0;
+            echo "::warning::mdpress attempt $a failed; retrying in 10s"; sleep 10; done; return 1; }
           mkdir -p "$GITHUB_WORKSPACE/dist"
           mdpress build --format pdf --output "$GITHUB_WORKSPACE/dist/docker_practice.pdf"