fix(docker): Alpine apk 镜像源 403 时自动回退阿里云/官方

- 新增 scripts/setup-alpine-mirrors.sh 探测可用镜像
- 移除硬编码清华源，runtime 固定 alpine:3.20 避免 latest 漂移

scripts/setup-alpine-mirrors.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Alpine apk 镜像源：按序探测可用镜像，避免单点 403 // Logan.Li
+set -eu
+
+ALPINE_VER=$(cut -d. -f1,2 /etc/alpine-release)
+ARCH=$(apk --print-arch 2>/dev/null || echo "x86_64")
+
+probe() {
+    local host=$1
+    local url="https://${host}/alpine/v${ALPINE_VER}/main/${ARCH}/APKINDEX.tar.gz"
+    if wget -q --spider "$url" 2>/dev/null; then
+        return 0
+    fi
+    if curl -fsSI --connect-timeout 8 "$url" >/dev/null 2>&1; then
+        return 0
+    fi
+    return 1
+}
+
+write_repos() {
+    local host=$1
+    printf 'https://%s/alpine/v%s/main\nhttps://%s/alpine/v%s/community\n' \
+        "$host" "$ALPINE_VER" "$host" "$ALPINE_VER" > /etc/apk/repositories
+}
+
+for host in mirrors.aliyun.com mirrors.cloud.tencent.com mirrors.ustc.edu.cn dl-cdn.alpinelinux.org; do
+    if probe "$host"; then
+        write_repos "$host"
+        echo "[apk-mirror] alpine v${ALPINE_VER} ${ARCH} -> ${host}"
+        exit 0
+    fi
+    echo "[apk-mirror] skip ${host} (unreachable)" >&2
+done
+
+echo "[apk-mirror] no mirror available for alpine v${ALPINE_VER}" >&2
+exit 1