Trust the registry key inside the mirror fix so Required never strands a client

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kb7vDj6PHwymeDeSUUk1eX

cn/lib/mirror.sh

@@ -14,6 +14,9 @@ cn_mirror_omarchy_repo_ok() {
 
 cn_mirror_omarchy_repo_fix() {
   local conf="${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+  # [omarchy] requires signed packages; the mirror re-signs with the registry key
+  sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc" > /dev/null
+  sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4 > /dev/null
   cn_mirror_omarchy_repo_ok && return 0
   sudo sed -i "s|^Server = https://pkgs.omarchy.org/stable/|Server = $CN_OMARCHY_MIRROR\nServer = https://pkgs.omarchy.org/stable/|" "$conf"
 }

cn/migrations/1787861071.sh

@@ -1,8 +1,5 @@
 echo "Trust the OmarchyCN registry key and put the [omarchy] mirror first"
 
-sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc"
-sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4
-
 # Only the stable channel is mirrored; edge/rc systems keep upstream directly
 source "$OMARCHY_PATH/cn/lib/mirror.sh"
 cn_mirror_omarchy_repo_fix