ci: use validated pip mirror for release gates

.github/workflows/build-test-quality-gate.yml

@@ -42,6 +42,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     env:
+      PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
       CONTRACT_API_ENVIRONMENT: test
       CONTRACT_API_DATABASE_URL: "sqlite+pysqlite:///:memory:"
       CONTRACT_API_DATABASE_AUTO_CREATE: "true"

.github/workflows/security-quality-gate.yml

@@ -16,6 +16,9 @@ jobs:
     name: npm audit, Bandit, pip-audit, detect-secrets
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    env:
+      PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
 
     steps:
       - name: Checkout

project-docs/V2-rc-freeze-2026-07-20.md

@@ -2,7 +2,7 @@
 
 ## Decision
 
-The current candidate is frozen for release review under tag `v2-rc-20260720`.
+The current candidate is frozen for release review under tag `v2-rc-20260720.1`.
 After the tag is created, only blocking bug fixes, tests, deployment configuration,
 and release documentation may be added. New product features and schema changes are
 outside this RC.
@@ -25,6 +25,11 @@ deployment/backup/health-check tooling, AI Provider acceptance tooling, authenti
 review-worker integration, ambient-proxy isolation for internal AI Platform calls,
 and per-key single-flight protection for Contract API read-cache misses.
 
+Tag `v2-rc-20260720.1` supersedes `v2-rc-20260720`. The original tag remains
+immutable; the only follow-up change pins the CI pip index to the same mirror already
+validated by the smoke deployment, preventing official-PyPI throughput from blocking
+the Python and security jobs before tests begin.
+
 ## Verification evidence
 
 | Gate | Result | Evidence |