ci: remove unreachable domestic mirrors, use official sources directly

Network testing revealed:
- static.rust-lang.org: direct 200/0.24s (fast, no proxy needed)
- sh.rustup.rs: direct 200/0.11s (fast)
- gitea.com: direct 303/0.68s (fast)
- mirrors.ustc.edu.cn: UNREACHABLE (5s timeout)
- rsproxy.cn: UNREACHABLE (5s timeout)

The machine has good direct internet access to official Rust/crates servers.
Domestic mirrors are the ones that are blocked. Remove all mirror config and
use defaults.

.github/workflows/ci.yml

@@ -35,7 +35,6 @@ jobs:
 
       - name: Install Rust toolchain (stable)
         run: |
-          export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal --component clippy
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
@@ -57,18 +56,6 @@ jobs:
             libclang-dev clang
 
       - name: Resolve LIBCLANG_PATH
-        # bindgen needs libclang on the LD path. The actual install location
-        # varies by Debian/Ubuntu version (llvm-14, llvm-15, ...), so we
-        # discover it dynamically instead of hardcoding /usr/lib/llvm-14/lib.
-        # Writing to $GITHUB_ENV propagates the value to subsequent steps
-        # inside the act_runner Docker container; the workflow-level `env:`
-        # block is not reliably visible there.
-        #
-        # Find pattern note: Debian Bookworm installs the runtime library as
-        # `libclang-14.so.1` (versioned, no plain libclang.so.* symlink),
-        # so a strict 'libclang.so.*' pattern returns nothing. The broader
-        # 'libclang*.so*' matches every bindgen-compatible filename variant:
-        # libclang.so, libclang-14.so, libclang.so.1, libclang-14.so.1.
         run: |
           set -e
           LIBCL=$(find /usr -name 'libclang*.so*' 2>/dev/null | head -1)
@@ -77,16 +64,6 @@ jobs:
           echo "Resolved LIBCLANG_PATH=$LIBDIR (found $LIBCL)"
           echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV"
 
-      - name: Configure cargo mirror (CI-only)
-        run: |
-          mkdir -p ~/.cargo
-          cat > ~/.cargo/config.toml <<'EOF'
-          [source.crates-io]
-          replace-with = "rsproxy-sparse"
-          [source.rsproxy-sparse]
-          registry = "sparse+https://rsproxy.cn/index/"
-          EOF
-
       - name: Clippy (release, all targets)
         run: cargo clippy --release --all-targets
 
@@ -99,27 +76,14 @@ jobs:
   audit:
     name: Security audit (RUSTSEC)
     runs-on: ubuntu-latest
-    # Keep separate from build-test so a vulnerability advisory fails the
-    # check independently of compile state.
     steps:
       - uses: https://gitea.com/actions/checkout@v4
 
       - name: Install Rust toolchain (stable)
         run: |
-          export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
-      - name: Configure cargo mirror (CI-only)
-        run: |
-          mkdir -p ~/.cargo
-          cat > ~/.cargo/config.toml <<'EOF'
-          [source.crates-io]
-          replace-with = "rsproxy-sparse"
-          [source.rsproxy-sparse]
-          registry = "sparse+https://rsproxy.cn/index/"
-          EOF
-
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked