ci: add rsproxy.cn cargo mirror for crates.io index access

The act_runner network also blocks crates.io index access (both sparse
and git protocols). Previous workaround used git protocol to github.com,
which is also blocked. Replace with rsproxy.cn sparse mirror, accessible
from China networks.

Added to both build-test and audit jobs. Config is written to
~/.cargo/config.toml at runtime (CI-only; does not affect local dev).

.github/workflows/ci.yml

@@ -25,10 +25,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  # The self-hosted act_runner network can terminate index.crates.io with a
-  # certificate that does not match the sparse-index hostname. Use Cargo's git
-  # index path in CI; GitHub access is already required for the actions above.
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: git
 
 jobs:
   build-test:
@@ -78,6 +74,16 @@ jobs:
           echo "Resolved LIBCLANG_PATH=$LIBDIR (found $LIBCL)"
           echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV"
 
+      - name: Configure cargo mirror (CI-only)
+        run: |
+          mkdir -p ~/.cargo
+          cat > ~/.cargo/config.toml <<'EOF'
+          [source.crates-io]
+          replace-with = "rsproxy-sparse"
+          [source.rsproxy-sparse]
+          registry = "sparse+https://rsproxy.cn/index/"
+          EOF
+
       - name: Cache cargo registry + build artifacts
         uses: https://gitea.com/actions/cache@v4
         with:
@@ -109,6 +115,16 @@ jobs:
       - name: Install Rust toolchain (stable)
         run: rustup toolchain install stable --profile minimal && rustup default stable
 
+      - name: Configure cargo mirror (CI-only)
+        run: |
+          mkdir -p ~/.cargo
+          cat > ~/.cargo/config.toml <<'EOF'
+          [source.crates-io]
+          replace-with = "rsproxy-sparse"
+          [source.rsproxy-sparse]
+          registry = "sparse+https://rsproxy.cn/index/"
+          EOF
+
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked