fix ci: use the Debian apt mirror for the Debian images

debian_image/debian_arm64_image got the Ubuntu TUNA mirror, so apt-get update 404'd on deb.debian.org paths and the images never built (red since v0.5.0). Add DEBIAN_APT_MIRROR and pass it to both debian builds.

.gitlab-ci.yml

@@ -8,6 +8,9 @@ variables:
   DOCKER_BUILDKIT: "1"
   # apt mirror used inside both images (override per pipeline if needed)
   APT_MIRROR: "http://mirrors.tuna.tsinghua.edu.cn/ubuntu"
+  # Debian images need the Debian (not Ubuntu) mirror path: the two repos live
+  # under /debian and /debian-security on the same host.
+  DEBIAN_APT_MIRROR: "http://mirrors.tuna.tsinghua.edu.cn/debian"
   # Images are shared through Harbor (plain HTTP), never as artifacts.
   HARBOR_HOST: "192.168.1.11:9090"
   HARBOR_PROJECT: "openra3"
@@ -178,7 +181,7 @@ debian_image:
       retry docker build \
         --cache-from type=registry,ref=$IMAGE:cache-debian,insecure=true \
         --cache-to type=registry,ref=$IMAGE:cache-debian,mode=max,insecure=true \
-        --build-arg APT_MIRROR=$APT_MIRROR \
+        --build-arg APT_MIRROR=$DEBIAN_APT_MIRROR \
         --target dev \
         -t $IMAGE:$CI_COMMIT_SHORT_SHA-debian \
         -f Dockerfile.debian .
@@ -197,7 +200,7 @@ debian_arm64_image:
       retry docker build \
         --cache-from type=registry,ref=$IMAGE:cache-debian-arm64,insecure=true \
         --cache-to type=registry,ref=$IMAGE:cache-debian-arm64,mode=max,insecure=true \
-        --build-arg APT_MIRROR=$APT_MIRROR \
+        --build-arg APT_MIRROR=$DEBIAN_APT_MIRROR \
         --target dev \
         -t $IMAGE:$CI_COMMIT_SHORT_SHA-debian-arm64 \
         -f Dockerfile.debian-arm64 .