Add fail-fast timeout and diagnostics to cargo hakari disable

cargo hakari disable in the docker image build has hung intermittently for 28-70 minutes (e.g. run 26514779485 attempt 1 sat on it for 28m45s before being cancelled). Crucially, cargo printed no output for the entire 28 min, so we do not yet know which phase actually stalled - it could be package-cache lock, libcurl/TLS init, DNS, TCP setup, sparse index download, or a git fetch. Without that, any "fix" is speculation.

This change is intentionally limited to two things, both about making the next hang useful:

* timeout-minutes: 5 - the step now fails fast at 5 min instead of occupying the 70-min job slot. Healthy cold-cache runs finish in ~2 min (worst non-stall observed ~3 min), so 5 min keeps a comfortable margin.

* verbose cargo logging plus a pre-kill watchdog snapshot - CARGO_TERM_VERBOSE, CARGO_HTTP_DEBUG, and a targeted CARGO_LOG give Rust-level and libcurl-level visibility; at 4m30s a background snapshot dumps the live process tree (with wait-channel) and open TCP sockets so a silent hang still leaves evidence of what cargo was actually doing.

Once a future hang reveals the stall point, the real fix can be targeted. No release note: internal CI infrastructure only.

Author: pcholakov

.github/workflows/docker.yml

@@ -98,9 +98,32 @@ jobs:
         with:
           tool: cargo-hakari
 
+      # This step has hung intermittently in CI for 28-70 min with no cargo output,
+      # so the stalled phase is unknown. The timeout caps how long a future stall
+      # can hold the runner; the verbose env and pre-kill snapshot exist so the
+      # next hang leaves enough trace to target a real fix.
       - name: Disable hakari
         if: ${{ hashFiles('.config/hakari.toml') != '' }}
-        run: cargo hakari disable
+        timeout-minutes: 5
+        env:
+          CARGO_TERM_VERBOSE: "true"
+          CARGO_HTTP_DEBUG: "true"
+          CARGO_LOG: "cargo::core::package=info,cargo::ops::registry=info,cargo::sources::registry=info,cargo::sources::git=info,cargo::util::network=info"
+        run: |
+          (
+            sleep 270
+            echo "::group::diagnostic snapshot at 4m30s (cargo still running)"
+            echo "--- process tree (pid/ppid/elapsed/state/wait-channel/cmd) ---"
+            ps -eo pid,ppid,etime,stat,wchan:25,args 2>/dev/null \
+              | awk 'NR==1 || /cargo|hakari|[g]it/'
+            echo "--- open TCP sockets for cargo/git ---"
+            (ss -tnp 2>/dev/null || netstat -tnp 2>/dev/null) \
+              | awk 'NR<=2 || /cargo|hakari|[g]it/'
+            echo "::endgroup::"
+          ) &
+          watchdog=$!
+          trap 'kill "$watchdog" 2>/dev/null; wait "$watchdog" 2>/dev/null || true' EXIT
+          cargo hakari disable
 
       # this is needed to be able to load and push a multiplatform image in one step
       - name: Set up Docker containerd snapshotter