Trust ArchLinuxCN before the China refresh upgrades through it; repair links before the cn rename

docs/regions.md

@@ -14,7 +14,7 @@ The China profile's `servers.sed` puts a `.omarchy.cn` twin ahead of every `.oma
 
 ## Switching an installed machine
 
-`omarchy-region cn|global` switches at runtime. China installs the input method, runs `install/config/region.sh` (region file, developer-mirror drop-ins, locale), refreshes pacman on the current channel, installs the profile `packages` and populates the ArchLinuxCN keyring. Global undoes the drop-ins and the locale and refreshes pacman back to the channel defaults. Neither touches home directories.
+`omarchy-region cn|global` switches at runtime. China installs the input method, runs `install/config/region.sh` (region file, developer-mirror drop-ins, locale), refreshes pacman on the current channel, installs the profile `packages` and populates the ArchLinuxCN keyring. China also sets up Rime Ice in the person's home. Global undoes the drop-ins and the locale, refreshes pacman back to the channel defaults, and removes the Claude Code API settings from the home; it keeps Rime.
 
 ## ISO builder contract
 
@@ -25,7 +25,7 @@ Regional content comes from the same runtime used by the ISO: either the `--loca
 - `packages`: additional target packages, one name per line, with blank lines and `#` comments allowed. The builder bundles them in the offline repository, and the installer installs them only when China is chosen. The source manifest is not modified.
 - `pacman/`: repository fragments used by the runtime finalizer. The builder also adds the community repository to its writable online config to obtain regional packages; it does not change its Arch channel mirrors.
 - `timezone` (optional): one zone name, such as `Asia/Shanghai`. The setup form preselects it in the timezone list when the network geo guess is unavailable, which is always the case offline. Both callers pass it: the ISO configurator from its copy of the profile, and first-boot setup from `default/regions/<region>/timezone` for the region in `/etc/omarchy/region`. A successful geo guess still wins, and the person can choose any other zone.
-- `environment.conf`, `cargo.toml`, `gemrc`, `maven-settings.xml`: developer-mirror drop-ins that `install/config/region.sh` symlinks into `/etc` and `/.cargo`.
+- `environment.conf`, `cargo.toml`, `gemrc`: developer-mirror drop-ins that `install/config/region.sh` symlinks into `/etc` and `/.cargo`. `maven-settings.xml` stays in the profile; `MAVEN_ARGS` in `environment.conf` points at it.
 - `skel/` (optional): new-user defaults. The ISO installer overlays these onto target `/etc/skel` after the base settings packages and before user creation, including installations that defer user creation until first boot. It never overlays existing home directories.
 
 For China, the builder installs `archlinuxcn-keyring` using the existing Arch trust chain before downloading other regional packages. Signature or keyring failures abort the build; no unverified keyserver trust or online signature bypass is added. The keyring is also installed on the target from the offline package set, then initialized and populated before online repositories are enabled. The ISO's existing offline repository verification policy is unchanged.