fix(ci): drop the healthy-default apt gate and prefer the VPC intranet mirror (#16260)

* fix(ci): drop the healthy-default gate so a fast apt burst cannot veto the mirror

The merged probe (#16218) kept a third gate: override only when the default
measured below 250 kB/s. On the mainland hosts the deb.debian.org path is
bimodal — run 41743539611 on hz4-2 probed 372 kB/s (a fast 512 KiB burst), so
the gate kept the default, and the sustained 200 MB transfer then throttled to
45 kB/s and hit the 60-minute cap again.

Remove that gate. The two mirror-side gates already cover the cases it was
meant to protect: the 1 MB/s absolute floor rejects a "slow vs slower"
override, and the 4x factor keeps a genuinely fast default (the Hong Kong
hosts) on the built-in source. The hz4-2 sample (default 372 kB/s, mirror
1.97 MB/s) now selects the mirror; the Hong Kong and both-slow shapes are
unchanged. The contract test pins the floor, the factor, and the absence of
any healthy-default gate.

* fix(ci): prefer the VPC intranet apt mirror to bypass the capped public egress

The public mirrors still traverse the pool's capped 100 Mbps public egress that
throttles under concurrent load — the exact problem configure-maven-mirror.sh
solves for Central by preferring mirrors.cloud.aliyuncs.com, which answers from
inside the VPC and consumes no public bandwidth. Add it as the first apt probe
candidate. Off the VPC (hosted runners, Hong Kong hosts) it is unreachable, the
probe measures 0, and a reachable public mirror wins — so no host map is needed
and the probe self-verifies on each build.

.github/scripts/run-e2e-tests.sh

@@ -59,19 +59,27 @@ if [ "$sandbox" = 'sandbox:docker' ]; then
 
   select_apt_mirror() {
     command -v curl > /dev/null 2>&1 || return 0
-    # Below this rate the two apt layers (~200 MB) would eat more than ~15 of
-    # this job's 60 minutes, so a faster mirror is worth the extra cache key.
-    # Above it the built-in source is healthy and is left untouched — which is
-    # what keeps a fixed mirror from slowing the Hong Kong hosts down.
-    local slow_default=250000
-    # A mirror also has to be fast in absolute terms, not merely faster than a
-    # broken default: without this floor, two slow endpoints would still
-    # "win" and move a host onto a mirror it never needed.
+    # Two gates, both on the mirror side. An absolute floor stops a "slow vs
+    # slower" override (two crawling endpoints must not move a host onto a
+    # mirror it never needed); the 4x factor keeps a genuinely fast default —
+    # the Hong Kong hosts — on the built-in source, since a mirror there is
+    # rarely 4x quicker. There is deliberately no "default looks healthy" gate:
+    # the mainland paths are bimodal, a 512 KiB probe can catch a fast burst
+    # (372 kB/s on hz4-2) while the sustained 200 MB transfer then throttles to
+    # 45 kB/s and times out (#16214 recurrence, run 41743539611). Trusting the
+    # mirror's own measured speed, not the default's, is what survives that.
     local fast_mirror=1000000
     local default_rate best_rate=0 best='' mirror rate
     default_rate="$(apt_mirror_probe_rate deb.debian.org)"
     default_rate="${default_rate:-0}"
-    for mirror in mirrors.aliyun.com mirrors.tuna.tsinghua.edu.cn; do
+    # mirrors.cloud.aliyuncs.com is the Alibaba Cloud VPC intranet mirror: it
+    # answers from inside the VPC and does not consume the instance's capped
+    # 100 Mbps public egress that throttles the public mirrors under concurrent
+    # load — the same reason configure-maven-mirror.sh prefers it for Central.
+    # Hosted runners and the Hong Kong hosts cannot reach it, so the probe just
+    # measures 0 there and it loses to a reachable public mirror; no host map is
+    # needed. Listed first because where it answers it is the fastest path.
+    for mirror in mirrors.cloud.aliyuncs.com mirrors.aliyun.com mirrors.tuna.tsinghua.edu.cn; do
       rate="$(apt_mirror_probe_rate "${mirror}")"
       rate="${rate:-0}"
       if [ "${rate}" -gt "${best_rate}" ]; then
@@ -82,8 +90,7 @@ if [ "$sandbox" = 'sandbox:docker' ]; then
     # Print the measurements: the next person debugging a slow image build
     # should not have to re-run this probe by hand (#16214).
     echo "apt probe: deb.debian.org=${default_rate} B/s best=${best_rate} B/s (${best:-none})" >&2
-    if [ -n "${best}" ] && [ "${default_rate}" -lt "${slow_default}" ] &&
-      [ "${best_rate}" -gt "${fast_mirror}" ] &&
+    if [ -n "${best}" ] && [ "${best_rate}" -gt "${fast_mirror}" ] &&
       [ "${best_rate}" -gt $((default_rate * 4)) ]; then
       printf '%s' "${best}"
     fi