fix(ci): retry the /privacy/ and /eula/ contour probe with a timeout

The single-shot probe raced the render sidecar during the rolling deploy: across two attempts a different route flaked each time (/privacy/, then /eula/) against an otherwise-healthy renderer, while the contour served all three pages correctly — a deploy-time transient (a slow first render of the large EULA while every container recreates, or a connection blip). Wrap the check in the same 20x3s retry the landing/gateway/backend probe uses, with a 10s per-attempt wget timeout, so it waits the transient out instead of failing the deploy.

.gitea/workflows/ci.yaml

@@ -539,12 +539,21 @@ jobs:
           # /privacy/ and /eula/ are static legal markdown rendered by the render sidecar (no backend
           # fetch). If the @legal caddy route is missing they fall to the landing shell (also 200), so
           # assert the page-specific canonical URL (the landing's is erudit-game.ru/) plus the seller
-          # INN — proving the rendered legal doc reached the edge, not the landing catch-all.
+          # INN — proving the rendered legal doc reached the edge, not the landing catch-all. Retry
+          # like the landing/gateway/backend probe: the renderer is recreated in this same deploy and
+          # a single-shot check can race its restart (it answers /offer/ then is briefly re-listening).
           for route in privacy eula; do
-            out="$(docker run --rm --network edge alpine:3.20 wget -q -O - "http://scrabble/${route}/" 2>&1 || true)"
-            if echo "$out" | grep -qF "erudit-game.ru/${route}/" && echo "$out" | grep -qF "290210610742"; then
-              echo "ok: /${route}/ serves the rendered legal page"
-            else
+            ok=
+            for i in $(seq 1 20); do
+              out="$(docker run --rm --network edge alpine:3.20 wget -q -T 10 -O - "http://scrabble/${route}/" 2>&1 || true)"
+              if echo "$out" | grep -qF "erudit-game.ru/${route}/" && echo "$out" | grep -qF "290210610742"; then
+                echo "ok: /${route}/ serves the rendered legal page"
+                ok=1
+                break
+              fi
+              sleep 3
+            done
+            if [ -z "$ok" ]; then
               echo "FAIL: /${route}/ did not serve the rendered legal page (@legal route missing?)"
               docker logs --tail 50 scrabble-renderer || true
               exit 1