CI/Docker NuGet: Nexus nuget-group primary + Liara fallback

Both the CI restore (/tmp/nuget.ci.config) and the Docker image build
(nuget.docker.config) now use https://mirror.soroushasadi.com/repository/
nuget-group/ as the primary source with Liara as fallback, so a single
mirror returning 500 no longer breaks restore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci-cd.yml

@@ -39,18 +39,18 @@ jobs:
           git fetch --depth=1 origin "${REF}"
           git checkout FETCH_HEAD
 
-      - name: Write NuGet config (Liara primary; Nexus optional)
-        # NOTE: mirror.soroushasadi.com currently serves an incomplete TLS chain
-        # (leaf only, no intermediate). .NET on Linux does NOT auto-fetch the
-        # intermediate via AIA the way Windows does, so it fails with PartialChain.
-        # Liara serves a complete chain, so it is the deterministic source here.
-        # Re-add Nexus once nginx points ssl_certificate at fullchain.pem.
+      - name: Write NuGet config (Nexus group primary; Liara fallback)
+        # Nexus nuget-group is the primary mirror; Liara is kept as a fallback so a
+        # single mirror outage (e.g. a 500 on the service index) doesn't break restore.
         run: |
           cat > /tmp/nuget.ci.config << 'EOF'
           <?xml version="1.0" encoding="utf-8"?>
           <configuration>
             <packageSources>
               <clear />
+              <add key="nexus"
+                   value="https://mirror.soroushasadi.com/repository/nuget-group/index.json"
+                   protocolVersion="3" />
               <add key="liara"
                    value="https://package-mirror.liara.ir/repository/nuget/index.json"
                    protocolVersion="3" />

nuget.docker.config

@@ -1,15 +1,16 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  NuGet source for the Docker image build (Linux .NET — runs `dotnet restore`
-  inside the SDK container). Uses the Liara mirror because it serves a complete
-  TLS chain. mirror.soroushasadi.com currently serves a leaf-only chain, which
-  .NET on Linux rejects with PartialChain (Windows auto-fetches the missing
-  intermediate via AIA; Linux does not). Re-add Nexus once nginx serves
-  fullchain.pem for mirror.soroushasadi.com.
+  NuGet sources for the Docker image build (Linux .NET — runs `dotnet restore`
+  inside the SDK container). Nexus nuget-group is primary; Liara is kept as a
+  fallback so a single mirror outage doesn't break the build. nuget.org is
+  filtered in Iran, so it is intentionally not listed.
 -->
 <configuration>
   <packageSources>
     <clear />
+    <add key="nexus"
+         value="https://mirror.soroushasadi.com/repository/nuget-group/index.json"
+         protocolVersion="3" />
     <add key="liara"
          value="https://package-mirror.liara.ir/repository/nuget/index.json"
          protocolVersion="3" />