ci: install GUI system libraries on intel-clean-room runners

.github/actions/setup-deps/action.yml

@@ -0,0 +1,29 @@
+name: setup-deps
+description: >-
+  Install GUI system libraries (gtk4, fltk, X11) with a retry loop. The
+  intel-clean-room runners share /var/lib/apt/lists/, so concurrent jobs
+  routinely collide on the apt list lock. apt's own DPkg::Lock::Timeout
+  only covers the dpkg lock, not the list lock — so we retry the whole
+  update+install up to 30 times with 10s gaps (~5 min total).
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        set +e
+        PKGS="libgtk-4-dev libpango1.0-dev libx11-dev libxext-dev libxft-dev \
+              libxinerama-dev libxcursor-dev libxrender-dev libxfixes-dev \
+              libpng-dev libgl1-mesa-dev libglu1-mesa-dev pkg-config cmake"
+        n=0
+        while [ $n -lt 30 ]; do
+          if sudo apt-get -o DPkg::Lock::Timeout=300 update -qq \
+             && sudo apt-get -o DPkg::Lock::Timeout=300 install -y --no-install-recommends $PKGS; then
+            exit 0
+          fi
+          n=$((n+1))
+          echo "::notice::apt attempt $n failed (likely shared-host lock contention), retrying in 10s..."
+          sleep 10
+        done
+        echo "::error::apt failed after 30 attempts"
+        exit 1

.github/workflows/ci.yml

@@ -29,28 +29,40 @@ jobs:
     runs-on: [self-hosted, intel]
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-deps
       - run: cargo clippy --workspace --all-targets --no-deps -- -D warnings
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target
 
   test:
     name: cargo test --workspace
     runs-on: [self-hosted, intel]
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-deps
       - run: cargo test --workspace --all-targets
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target
 
   contracts:
     name: provable contracts (lib tests)
     runs-on: [self-hosted, intel]
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-deps
       - run: cargo test --workspace --lib
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target
 
   coverage:
     name: cargo llvm-cov (workspace lib, 100% lines)
     runs-on: [self-hosted, intel]
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-deps
       - run: cargo llvm-cov --workspace --lib --ignore-filename-regex '(src/bin/|target/)' --fail-under-lines 100 --fail-under-functions 100
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/cargo-target
 
   deny:
     name: cargo deny check advisories|licenses|bans|sources

README.md

@@ -5,6 +5,8 @@
 [![Rust](https://img.shields.io/badge/rust-1.93%2B-orange.svg)](https://www.rust-lang.org)
 [![Coverage](https://img.shields.io/badge/coverage-100%25-brightgreen.svg)](#quality-gates)
 
+![Side-by-side Rust GUI demos: iced todo, fltk calculator, gtk4 password generator, relm4 Simon Says, egui counter](assets/hero.svg)
+
 Side-by-side Rust GUI demos across **iced**, **fltk**, **gtk4**, **relm4**,
 and **egui** — each with a provable contract on its core state machine,
 100% line-and-function coverage on its logic crate, and a strict