Propagate key-trust failures and let doctor --fix heal a keyless mirror line

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kb7vDj6PHwymeDeSUUk1eX

bin/omarchy-cn-doctor

@@ -78,14 +78,16 @@ check_omarchy_repo() {
     echo "INFO omarchy-repo: 非 stable 通道，跳过 OmarchyCN 镜像检查"
     return 0
   fi
-  if cn_mirror_omarchy_repo_ok; then
+  # --fix runs the helper even when the line is present: it also heals a missing key
+  if [[ $fix == "true" ]]; then
+    if cn_mirror_omarchy_repo_fix && cn_mirror_omarchy_repo_ok; then
+      echo "PASS omarchy-repo: OmarchyCN 镜像行与 registry 公钥在位"
+      return 0
+    fi
+  elif cn_mirror_omarchy_repo_ok; then
     echo "PASS omarchy-repo: OmarchyCN 镜像行在位"
     return 0
   fi
-  if [[ $fix == "true" ]] && cn_mirror_omarchy_repo_fix && cn_mirror_omarchy_repo_ok; then
-    echo "PASS omarchy-repo: 已重新插入 OmarchyCN 镜像行"
-    return 0
-  fi
   echo "FAIL omarchy-repo: [omarchy] 缺 OmarchyCN 镜像行（omarchycn doctor mirror --fix 可修复）"
   failures=$((failures + 1))
 }

cn/lib/mirror.sh

@@ -15,8 +15,8 @@ cn_mirror_omarchy_repo_ok() {
 cn_mirror_omarchy_repo_fix() {
   local conf="${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
   # [omarchy] requires signed packages; the mirror re-signs with the registry key
-  sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc" > /dev/null
-  sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4 > /dev/null
+  sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc" > /dev/null || return 1
+  sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4 > /dev/null || return 1
   cn_mirror_omarchy_repo_ok && return 0
   sudo sed -i "s|^Server = https://pkgs.omarchy.org/stable/|Server = $CN_OMARCHY_MIRROR\nServer = https://pkgs.omarchy.org/stable/|" "$conf"
 }