ci(desktop): add skipVlcSetup opt-out to bypass flaky VLC downloads

get.videolan.org regularly times out from GitHub-hosted runners and
Claude Code web sandboxes, taking the desktop CI build down with it
even though the failure is unrelated to the change under review.

Wire a -PskipVlcSetup=true (env: AMETHYST_SKIP_VLC=true) opt-out in
desktopApp/build.gradle.kts that disables the vlcDownload, upxDownload,
and vlcSetup tasks. Pass it from build.yml so PR CI no longer gates on
VLC reachability, and export the env from the CCW session-start hook.

Release packaging (create-release.yml) intentionally does not set the
flag, so shipped artifacts still bundle VLC.

.claude/hooks/session-start.sh

@@ -172,6 +172,10 @@ if [ -n "${CLAUDE_ENV_FILE:-}" ]; then
   echo "export ANDROID_HOME=$ANDROID_SDK_DIR" >> "$CLAUDE_ENV_FILE"
   echo "export ANDROID_SDK_ROOT=$ANDROID_SDK_DIR" >> "$CLAUDE_ENV_FILE"
   echo "export PATH=\$PATH:$ANDROID_SDK_DIR/platform-tools" >> "$CLAUDE_ENV_FILE"
+  # get.videolan.org is unreachable / heavily rate-limited from CCW egress,
+  # so disable the desktopApp vlcDownload / upxDownload / vlcSetup tasks by
+  # default. See desktopApp/build.gradle.kts for the opt-out wiring.
+  echo "export AMETHYST_SKIP_VLC=true" >> "$CLAUDE_ENV_FILE"
 fi
 
 # --- Kotlin/Native: pre-install native dependencies (GCC sysroot, LLDB) ---

.github/workflows/build.yml

@@ -65,8 +65,13 @@ jobs:
           java-version: 21
           cache: gradle
 
+      # `-PskipVlcSetup=true` disables the vlcDownload / upxDownload / vlcSetup
+      # tasks (see desktopApp/build.gradle.kts). PR CI artifacts are smoke-test
+      # only — get.videolan.org is too flaky from GitHub-hosted runners to gate
+      # PRs on. Release packaging (create-release.yml) deliberately omits this
+      # flag so shipped artifacts still bundle VLC.
       - name: Test + Build Desktop (gradle)
-        run: ./gradlew :quartz:jvmTest :commons:jvmTest :nestsClient:jvmTest :cli:test :desktopApp:test :desktopApp:${{ matrix.desktop-task }} --no-daemon
+        run: ./gradlew :quartz:jvmTest :commons:jvmTest :nestsClient:jvmTest :cli:test :desktopApp:test :desktopApp:${{ matrix.desktop-task }} --no-daemon -PskipVlcSetup=true
 
       # jpackage pins libicu to the build host's version (libicu74 on
       # ubuntu-24.04). Rewrite the .deb so testers on other Debian/Ubuntu

desktopApp/build.gradle.kts

@@ -164,6 +164,24 @@ tasks.withType<Download>().configureEach {
     tempAndMove(true)
 }
 
+// Opt-out for VLC bundling. CI (build.yml) and ephemeral build sandboxes
+// (Claude Code web) routinely lose connectivity to get.videolan.org and the
+// retry budget above is not enough to mask it. Setting `-PskipVlcSetup=true`
+// (or env `AMETHYST_SKIP_VLC=true`) disables the vlc/upx download + extract
+// tasks so packaging proceeds without bundling VLC. The release workflow
+// (create-release.yml) does NOT set this, so production artifacts still ship
+// with VLC bundled.
+val skipVlcSetup =
+    (project.findProperty("skipVlcSetup") as? String)?.toBoolean() == true ||
+        System.getenv("AMETHYST_SKIP_VLC") == "true"
+
+if (skipVlcSetup) {
+    logger.lifecycle("desktopApp: skipVlcSetup=true — disabling vlcDownload/upxDownload/vlcSetup. Built artifacts will NOT bundle VLC.")
+    tasks.matching { it.name in setOf("vlcDownload", "upxDownload", "vlcSetup") }.configureEach {
+        enabled = false
+    }
+}
+
 // --- AppImage packaging (Linux) ---
 //
 // Compose Multiplatform's TargetFormat.AppImage is known-broken in 1.10.x (CMP-7101).