ci: clamp MTU to 1280 in all alpine steps and DinD service

Path MTU to external destinations is ~1280 from the new cluster
(PMTUD broken upstream, packets >1280 are silently dropped). Force
eth0 MTU to 1280 at the start of every step (needs privileged), drop
the DinD inner bridge from 1420 to 1280, and wrap each apk add in a
short retry loop to absorb any remaining transient failures.

Workflow-side workaround; the proper fix is to lower the CNI/host
docker daemon MTU at the infra layer.

.crow/build.yaml

@@ -89,7 +89,9 @@ steps:
 
   - name: Net debug
     image: reg.devxy.io/docker.io/library/alpine:3.23
+    privileged: true
     commands:
+      - ip link set dev eth0 mtu 1280 2>/dev/null || true
       - echo "=== pod interface ==="
       - cat /sys/class/net/eth0/mtu
       - ip -o link show eth0
@@ -114,8 +116,10 @@ steps:
 
   - name: Get latest R version
     image: reg.devxy.io/docker.io/library/alpine:3.23
+    privileged: true
     commands:
-      - apk add -q --no-cache curl jq
+      - ip link set dev eth0 mtu 1280 2>/dev/null || true
+      - for i in 1 2 3 4 5; do apk add -q --no-cache curl jq && break; sleep 5; done
       - curl -sf https://formulae.brew.sh/api/formula/r.json | jq -er '.versions.stable' > r-version-to-build.txt
       # - echo "4.1.3" > r-version-to-build.txt
       - cat r-version-to-build.txt
@@ -134,8 +138,10 @@ steps:
 
   - name: Check if files for R version already exist in s3
     image: reg.devxy.io/docker.io/library/alpine:3.23
+    privileged: true
     commands:
-      - apk add -q --no-cache curl
+      - ip link set dev eth0 mtu 1280 2>/dev/null || true
+      - for i in 1 2 3 4 5; do apk add -q --no-cache curl && break; sleep 5; done
       - |
           VERSION=$(cat r-version-to-build.txt)
           curl -s "https://s3.eu-central-003.backblazeb2.com/devxy-r-builds?prefix=${PLATFORM_ID}/" | \
@@ -156,9 +162,10 @@ steps:
     environment:
       DOCKER_HOST: tcp://docker:2375
     commands: |
+      ip link set dev eth0 mtu 1280 2>/dev/null || true
       # docker info
       if ! grep -qF "$(cat r-version-to-build.txt)" r-version-s3.txt; then
-        apk add -q --no-cache make just docker-compose
+        for i in 1 2 3 4 5; do apk add -q --no-cache make just docker-compose && break; sleep 5; done
         just build-r-${PLATFORM} $(cat r-version-to-build.txt)
       fi
     backend_options:
@@ -214,8 +221,9 @@ services:
       DOCKER_TLS_CERTDIR: ""
     image: reg.devxy.io/docker.io/library/docker:29-dind
     commands:
+      - ip link set dev eth0 mtu 1280 2>/dev/null || true
       - mkdir -p /tmp/${PLATFORM}/${ARCH}
-      - dockerd --tls=false --mtu 1420 --host=tcp://0.0.0.0:2375
+      - dockerd --tls=false --mtu 1280 --host=tcp://0.0.0.0:2375
     privileged: true
     ports:
       - 2375