Put the OmarchyCN [omarchy] mirror first on the stable channel

The Gitea mirror db is registry-signed, so installs trust the registry
key right after the pacman.conf restore, and a cn migration does the
same on existing systems with an idempotent exact-line guard. The
insertion lives in cn/lib/mirror.sh so 'omarchycn doctor mirror --fix'
can restore the line after omarchy-refresh-pacman resets an overlay
system's conf. Only stable is mirrored: the Gitea repository name must
equal the pacman section name, and edge/rc stay on upstream directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019hLK3wsDuKVAC37GgDqg6H

default/pacman/pacman-stable.conf

@@ -27,4 +27,6 @@ Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
 SigLevel = Optional TrustAll
+# OmarchyCN mirror first (registry-signed db, key via cn/keys), upstream fallback
+Server = https://git.zacharyzhang.com/api/packages/ZacharyZhang-NY/arch/omarchy/x86_64
 Server = https://pkgs.omarchy.org/stable/$arch