CI/Docker NuGet: Nexus-only (drop Liara fallback)

NuGet loads the service index of EVERY listed source, so a 500 from the
Liara fallback aborted the whole restore (NU1301) even though Nexus was
healthy. Mirror cert chain is fixed now, so use our Nexus mirror as the
single source of truth.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci-cd.yml

@@ -39,9 +39,10 @@ jobs:
           git fetch --depth=1 origin "${REF}"
           git checkout FETCH_HEAD
 
-      - name: Write NuGet config (Nexus group primary; Liara fallback)
-        # Nexus nuget-group is the primary mirror; Liara is kept as a fallback so a
-        # single mirror outage (e.g. a 500 on the service index) doesn't break restore.
+      - name: Write NuGet config (Nexus only)
+        # Single source = our Nexus mirror. We do NOT list Liara as a fallback: NuGet loads
+        # the service index of EVERY configured source, so a 500 from a fallback aborts the
+        # whole restore (NU1301). Nexus is the source of truth.
         run: |
           cat > /tmp/nuget.ci.config << 'EOF'
           <?xml version="1.0" encoding="utf-8"?>
@@ -51,9 +52,6 @@ jobs:
               <add key="nexus"
                    value="https://mirror.soroushasadi.com/repository/nuget-group/index.json"
                    protocolVersion="3" />
-              <add key="liara"
-                   value="https://package-mirror.liara.ir/repository/nuget/index.json"
-                   protocolVersion="3" />
             </packageSources>
             <config>
               <add key="http_retry_count" value="6" />

nuget.docker.config

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  NuGet sources for the Docker image build (Linux .NET — runs `dotnet restore`
-  inside the SDK container). Nexus nuget-group is primary; Liara is kept as a
-  fallback so a single mirror outage doesn't break the build. nuget.org is
-  filtered in Iran, so it is intentionally not listed.
+  NuGet source for the Docker image build (Linux .NET — runs `dotnet restore`
+  inside the SDK container). Single source = our Nexus mirror. We deliberately
+  do NOT list a fallback: NuGet loads the service index of every configured
+  source, so a 500 from a fallback would abort the whole restore. nuget.org is
+  filtered in Iran and is intentionally absent — Nexus is the source of truth.
 -->
 <configuration>
   <packageSources>
@@ -11,9 +12,6 @@
     <add key="nexus"
          value="https://mirror.soroushasadi.com/repository/nuget-group/index.json"
          protocolVersion="3" />
-    <add key="liara"
-         value="https://package-mirror.liara.ir/repository/nuget/index.json"
-         protocolVersion="3" />
   </packageSources>
   <config>
     <add key="http_retry_count" value="8" />