CI/Docker NuGet: Nexus-only (drop Liara fallback)

NuGet loads the service index of EVERY listed source, so a 500 from the
Liara fallback aborted the whole restore (NU1301) even though Nexus was
healthy. Mirror cert chain is fixed now, so use our Nexus mirror as the
single source of truth.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nuget.docker.config

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  NuGet sources for the Docker image build (Linux .NET — runs `dotnet restore`
-  inside the SDK container). Nexus nuget-group is primary; Liara is kept as a
-  fallback so a single mirror outage doesn't break the build. nuget.org is
-  filtered in Iran, so it is intentionally not listed.
+  NuGet source for the Docker image build (Linux .NET — runs `dotnet restore`
+  inside the SDK container). Single source = our Nexus mirror. We deliberately
+  do NOT list a fallback: NuGet loads the service index of every configured
+  source, so a 500 from a fallback would abort the whole restore. nuget.org is
+  filtered in Iran and is intentionally absent — Nexus is the source of truth.
 -->
 <configuration>
   <packageSources>
@@ -11,9 +12,6 @@
     <add key="nexus"
          value="https://mirror.soroushasadi.com/repository/nuget-group/index.json"
          protocolVersion="3" />
-    <add key="liara"
-         value="https://package-mirror.liara.ir/repository/nuget/index.json"
-         protocolVersion="3" />
   </packageSources>
   <config>
     <add key="http_retry_count" value="8" />