ci: add stuck_or_timeout_failure retry to all remaining jobs

Unstable runners occasionally get stuck in the prepare phase with no
log output. Any job can be affected. Adding retry: max: 1, when:
stuck_or_timeout_failure to all remaining jobs that lacked it:

quick-checks: check-dependency-rules, check-fail-ci,
  check-workspace-integrity, check-zepter, test-rust-features,
  check-umbrella, check-licenses-headers

security: cargo-deny-sources, cargo-audit

checks: check-core-crypto-features

Clippy and check-try-runtime excluded — retrying 36m/81m jobs on
actual timeout would be too expensive; those get runner_system_failure
coverage for runner crashes instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -81,11 +81,17 @@ check-toml-format:
 
 check-dependency-rules:
   stage: quick-checks
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - cd bizinikiwi/ && ../.gitlab/ensure-deps.sh
 
 check-fail-ci:
   stage: quick-checks
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - |
       if rg --line-number --hidden --type rust --glob '!{.git,target}' "FAIL-CI" .; then
@@ -98,6 +104,9 @@ check-workspace-integrity:
   stage: quick-checks
   variables:
     CARGO_HOME: /root/.cargo
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - pip3 install toml "cargo-workspace>=1.2.6" --quiet
     - |
@@ -107,6 +116,9 @@ check-workspace-integrity:
 
 check-zepter:
   stage: quick-checks
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - cargo metadata --format-version=1 --locked > /dev/null
     - cargo install zepter@1.82.1 --force
@@ -116,11 +128,17 @@ check-zepter:
 
 test-rust-features:
   stage: quick-checks
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - bash .gitlab/rust-features.sh .
 
 check-umbrella:
   stage: quick-checks
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - pip3 install "cargo-workspace>=1.2.4" toml --quiet
     - cargo install zepter@1.82.1 --force --quiet
@@ -147,6 +165,9 @@ check-umbrella:
 
 check-licenses-headers:
   stage: quick-checks
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - |
       FAIL=0
@@ -206,6 +227,9 @@ check-try-runtime:
 check-core-crypto-features:
   stage: checks
   needs: [fmt]
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - rustup target add wasm32v1-none
     - |
@@ -254,6 +278,9 @@ cargo-deny-sources:
   stage: security
   needs: []
   before_script: []
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - cargo install cargo-deny --locked -q
     - cargo deny check sources --config deny.toml
@@ -266,6 +293,9 @@ cargo-audit:
   stage: security
   needs: []
   before_script: []
+  retry:
+    max: 1
+    when: stuck_or_timeout_failure
   script:
     - cargo install cargo-audit --locked -q
     - cargo audit --json 2>/dev/null > /tmp/audit.json || true