Trust ArchLinuxCN before the China refresh upgrades through it; repair links before the cn rename

bin/omarchy-region

@@ -36,11 +36,14 @@ if [[ $1 == "cn" ]]; then
   # Packages first against current mirrors, so a failed install leaves the machine Global.
   omarchy-update-pacman -Syu --noconfirm
   sudo env OMARCHY_REGION=cn OMARCHY_PATH="$OMARCHY_PATH" bash -e "$OMARCHY_PATH/install/config/region.sh"
-  # The refresh renders the cn profile: .cn mirrors first, USTC after, and ArchLinuxCN, whose keyring comes from it.
-  omarchy-refresh-pacman "$channel"
+  # Trust ArchLinuxCN before the refresh upgrades through it.
+  rendered=$(mktemp -d)
+  trap 'rm -rf "$rendered"' EXIT
+  omarchy-apply-pacman --render "$channel" "$rendered"
   mapfile -t profile_packages < <(grep -Ev '^[[:space:]]*(#|$)' "$OMARCHY_PATH/default/regions/cn/packages")
-  omarchy-pkg-add "${profile_packages[@]}"
+  sudo pacman --config "$rendered/pacman.conf" -Sy --noconfirm --needed "${profile_packages[@]}"
   sudo pacman-key --populate archlinuxcn
+  omarchy-refresh-pacman "$channel"
   if [[ ! -f $HOME/.local/share/fcitx5/rime/rime_ice.schema.yaml ]]; then
     # A running fcitx5 only sees the new Rime addon after a restart.
     systemctl --user try-restart omarchy-fcitx5.service