CI/Docker NuGet: Nexus nuget-group primary + Liara fallback

Both the CI restore (/tmp/nuget.ci.config) and the Docker image build
(nuget.docker.config) now use https://mirror.soroushasadi.com/repository/
nuget-group/ as the primary source with Liara as fallback, so a single
mirror returning 500 no longer breaks restore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nuget.docker.config

@@ -1,15 +1,16 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  NuGet source for the Docker image build (Linux .NET — runs `dotnet restore`
-  inside the SDK container). Uses the Liara mirror because it serves a complete
-  TLS chain. mirror.soroushasadi.com currently serves a leaf-only chain, which
-  .NET on Linux rejects with PartialChain (Windows auto-fetches the missing
-  intermediate via AIA; Linux does not). Re-add Nexus once nginx serves
-  fullchain.pem for mirror.soroushasadi.com.
+  NuGet sources for the Docker image build (Linux .NET — runs `dotnet restore`
+  inside the SDK container). Nexus nuget-group is primary; Liara is kept as a
+  fallback so a single mirror outage doesn't break the build. nuget.org is
+  filtered in Iran, so it is intentionally not listed.
 -->
 <configuration>
   <packageSources>
     <clear />
+    <add key="nexus"
+         value="https://mirror.soroushasadi.com/repository/nuget-group/index.json"
+         protocolVersion="3" />
     <add key="liara"
          value="https://package-mirror.liara.ir/repository/nuget/index.json"
          protocolVersion="3" />