CI/Docker NuGet: Nexus nuget-group primary + Liara fallback

Both the CI restore (/tmp/nuget.ci.config) and the Docker image build
(nuget.docker.config) now use https://mirror.soroushasadi.com/repository/
nuget-group/ as the primary source with Liara as fallback, so a single
mirror returning 500 no longer breaks restore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci-cd.yml

@@ -39,18 +39,18 @@ jobs:
           git fetch --depth=1 origin "${REF}"
           git checkout FETCH_HEAD
 
-      - name: Write NuGet config (Liara primary; Nexus optional)
-        # NOTE: mirror.soroushasadi.com currently serves an incomplete TLS chain
-        # (leaf only, no intermediate). .NET on Linux does NOT auto-fetch the
-        # intermediate via AIA the way Windows does, so it fails with PartialChain.
-        # Liara serves a complete chain, so it is the deterministic source here.
-        # Re-add Nexus once nginx points ssl_certificate at fullchain.pem.
+      - name: Write NuGet config (Nexus group primary; Liara fallback)
+        # Nexus nuget-group is the primary mirror; Liara is kept as a fallback so a
+        # single mirror outage (e.g. a 500 on the service index) doesn't break restore.
         run: |
           cat > /tmp/nuget.ci.config << 'EOF'
           <?xml version="1.0" encoding="utf-8"?>
           <configuration>
             <packageSources>
               <clear />
+              <add key="nexus"
+                   value="https://mirror.soroushasadi.com/repository/nuget-group/index.json"
+                   protocolVersion="3" />
               <add key="liara"
                    value="https://package-mirror.liara.ir/repository/nuget/index.json"
                    protocolVersion="3" />