ci(codeql): persistent self-hosted Conan home + bounded restore retry

The Analyze (c-cpp) job intermittently failed on Install Conan dependencies
with "Failed to restore: The operation cannot be completed in timeout",
false-redding verified-good release PRs (#751, #756, #758).

Root cause is the same shape as the web-static Chrome flake fixed in #748: a
self-hosted job pulling a large payload over the network on every run.
CONAN_HOME was pinned to $RUNNER_TEMP/conan2 unconditionally, so each
self-hosted CodeQL run started with an empty Conan home and depended on
actions/cache restoring a multi-hundred-MB tree from the GitHub cache service
onto VM905. That restore times out under load; on a miss it also forced a
from-source boost rebuild.

- self-hosted: CONAN_HOME=$HOME/.conan2-codeql, persistent across runs.
  Dedicated path rather than the shared ~/.conan2, preserving the torn-cache
  isolation from #704/#710; this workflow serialises per ref via its
  concurrency group, so nothing else writes that home.
- actions/cache restore is now github-hosted (fork PR) only.
- conan install wrapped in a 3x bounded retry with backoff for transient
  remote hiccups.

build-mode stays manual: CodeQL c-cpp requires a real build, and none/autobuild
would either drop analysis coverage or still need the same Conan step.

Author: frstrtr

.github/workflows/codeql-analysis.yml

@@ -48,8 +48,22 @@ jobs:
           queries: security-and-quality
 
       - if: matrix.build-mode == 'manual'
-        name: Set per-job Conan home
-        run: echo "CONAN_HOME=$RUNNER_TEMP/conan2" >> "$GITHUB_ENV"
+        name: Set Conan home
+        run: |
+          # github-hosted: ephemeral per-job home, warmed by actions/cache below.
+          # self-hosted:   PERSISTENT home dedicated to this workflow. Restoring a
+          # multi-hundred-MB conan2 tree from the GH cache service onto VM905 is
+          # the flake ("Failed to restore: The operation cannot be completed in
+          # timeout"), and on a miss it forced a from-source boost rebuild too.
+          # A local persistent home takes the network off the hot path.
+          # Dedicated path (NOT the shared ~/.conan2) preserves the torn-cache
+          # isolation from #704/#710; this workflow's concurrency group
+          # serialises CodeQL per ref, so nothing else writes this home.
+          if [ "${{ runner.environment }}" = "github-hosted" ]; then
+            echo "CONAN_HOME=$RUNNER_TEMP/conan2" >> "$GITHUB_ENV"
+          else
+            echo "CONAN_HOME=$HOME/.conan2-codeql" >> "$GITHUB_ENV"
+          fi
 
       # ── C++ build (manual mode only) ─────────────────────────────────────
       - if: matrix.build-mode == 'manual' && runner.environment == 'github-hosted'
@@ -78,8 +92,8 @@ jobs:
             conan --version   # pre-provisioned at /usr/local/bin on self-hosted
           fi
 
-      - if: matrix.build-mode == 'manual'
-        name: Restore Conan package cache
+      - if: matrix.build-mode == 'manual' && runner.environment == 'github-hosted'
+        name: Restore Conan package cache (github-hosted only)
         uses: actions/cache@v5
         with:
           path: ${{ runner.temp }}/conan2
@@ -93,13 +107,24 @@ jobs:
 
       - if: matrix.build-mode == 'manual'
         name: Install Conan dependencies
+        # Bounded retry: remote package downloads are the only network step left
+        # here, and a transient remote/CDN hiccup should not red a verified-good
+        # release PR.
         run: |
-          conan install . \
-            -pr:a=ci/conan/linux-gcc13.profile \
-            --lockfile=conan.lock \
-            --build=missing \
-            --output-folder=build_codeql \
-            --settings=build_type=Release
+          for attempt in 1 2 3; do
+            if conan install . \
+                 -pr:a=ci/conan/linux-gcc13.profile \
+                 --lockfile=conan.lock \
+                 --build=missing \
+                 --output-folder=build_codeql \
+                 --settings=build_type=Release; then
+              exit 0
+            fi
+            echo "conan install failed (attempt $attempt/3); retrying in $((attempt * 15))s"
+            sleep $((attempt * 15))
+          done
+          echo "conan install failed after 3 attempts" >&2
+          exit 1
 
       - if: matrix.build-mode == 'manual'
         name: Build for CodeQL analysis