Put the OmarchyCN [omarchy] mirror first on the stable channel

The Gitea mirror db is registry-signed, so installs trust the registry
key right after the pacman.conf restore, and a cn migration does the
same on existing systems with an idempotent exact-line guard. The
insertion lives in cn/lib/mirror.sh so 'omarchycn doctor mirror --fix'
can restore the line after omarchy-refresh-pacman resets an overlay
system's conf. Only stable is mirrored: the Gitea repository name must
equal the pacman section name, and edge/rc stay on upstream directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019hLK3wsDuKVAC37GgDqg6H

cn/lib/mirror.sh

@@ -4,6 +4,19 @@
 CN_MIRRORS_JSON="$OMARCHY_PATH/cn/mirrors.json"
 CN_MIRRORLIST="/etc/pacman.d/mirrorlist"
 CN_PROFILE_FILE="$HOME/.config/omarchycn/mirror-profile"
+CN_OMARCHY_MIRROR="https://git.zacharyzhang.com/api/packages/ZacharyZhang-NY/arch/omarchy/x86_64"
+
+# [omarchy] mirror line management (stable channel only); shared by the
+# rollout migration and doctor --fix so refresh-pacman resets stay healable
+cn_mirror_omarchy_repo_ok() {
+  grep -qxF "Server = $CN_OMARCHY_MIRROR" "${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+}
+
+cn_mirror_omarchy_repo_fix() {
+  local conf="${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+  cn_mirror_omarchy_repo_ok && return 0
+  sudo sed -i "s|^Server = https://pkgs.omarchy.org/stable/|Server = $CN_OMARCHY_MIRROR\nServer = https://pkgs.omarchy.org/stable/|" "$conf"
+}
 
 cn_mirror_ids() {
   jq -r '.mirrors[].id' "$CN_MIRRORS_JSON"

cn/migrations/1787861071.sh

@@ -0,0 +1,8 @@
+echo "Trust the OmarchyCN registry key and put the [omarchy] mirror first"
+
+sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc"
+sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4
+
+# Only the stable channel is mirrored; edge/rc systems keep upstream directly
+source "$OMARCHY_PATH/cn/lib/mirror.sh"
+cn_mirror_omarchy_repo_fix