ci: address self-review findings

- Wire up warm-bench: set BENCH_CACHE_DIR on the setup job so the bench-base
  cache actually activates (was inert with no dir set, so every run did a
  full bench init). Lives on the node-local bench-staging hostPath; any
  miss/failure still falls back to a full init.
- run_ci_step: capture the timeout exit code under `set -e` (the previous
  `timeout ...` + `ec=$?` aborted at the timeout line on failure, skipping
  ::endgroup:: and the exit-code return).
- Raise the per-step timeout 600s -> 1800s so a contended reinstall isn't
  killed before the 40-min job timeout.
- Propagate DB through the su re-exec in start-db.sh / hydrate.sh so a
  DB=postgres invocation can't silently fall back to the mariadb branch.
- Simplify the coverage job `if` to the equivalent plain non-PR gate.

.github/helper/install.sh

@@ -74,8 +74,8 @@ run_ci_step() {
 
     echo "::group::${label}"
     date -u
-    timeout --foreground "${CI_INSTALL_STEP_TIMEOUT:-600}" "$@"
-    local exit_code=$?
+    local exit_code=0
+    timeout --foreground "${CI_INSTALL_STEP_TIMEOUT:-1800}" "$@" || exit_code=$?
     date -u
     echo "::endgroup::"
     return "$exit_code"