Put the OmarchyCN [omarchy] mirror first on the stable channel

The Gitea mirror db is registry-signed, so installs trust the registry
key right after the pacman.conf restore, and a cn migration does the
same on existing systems with an idempotent exact-line guard. The
insertion lives in cn/lib/mirror.sh so 'omarchycn doctor mirror --fix'
can restore the line after omarchy-refresh-pacman resets an overlay
system's conf. Only stable is mirrored: the Gitea repository name must
equal the pacman section name, and edge/rc stay on upstream directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019hLK3wsDuKVAC37GgDqg6H

bin/omarchy-cn-doctor

@@ -69,6 +69,27 @@ check_mirror() {
   fi
 }
 
+# refresh-pacman restores the checkout's template, which on overlay installs
+# has no OmarchyCN mirror line; this check makes that loss visible and fixable
+check_omarchy_repo() {
+  local conf="${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+
+  if ! grep -q "^Server = https://pkgs.omarchy.org/stable/" "$conf"; then
+    echo "INFO omarchy-repo: 非 stable 通道，跳过 OmarchyCN 镜像检查"
+    return 0
+  fi
+  if cn_mirror_omarchy_repo_ok; then
+    echo "PASS omarchy-repo: OmarchyCN 镜像行在位"
+    return 0
+  fi
+  if [[ $fix == "true" ]] && cn_mirror_omarchy_repo_fix && cn_mirror_omarchy_repo_ok; then
+    echo "PASS omarchy-repo: 已重新插入 OmarchyCN 镜像行"
+    return 0
+  fi
+  echo "FAIL omarchy-repo: [omarchy] 缺 OmarchyCN 镜像行（omarchycn doctor mirror --fix 可修复）"
+  failures=$((failures + 1))
+}
+
 check_dev_mirror() {
   omarchy-cn-dev-mirror-doctor || failures=$((failures + 1))
 }
@@ -79,12 +100,16 @@ check_ime() {
 
 case "$module" in
 network) check_network ;;
-mirror) check_mirror ;;
+mirror)
+  check_mirror
+  check_omarchy_repo
+  ;;
 dev-mirror) check_dev_mirror ;;
 ime) check_ime ;;
 all)
   check_network
   check_mirror
+  check_omarchy_repo
   check_dev_mirror
   check_ime
   ;;