ci: canary Shanghai Go proxy for UT

[loveRhythm1990]

Summary

• Probe the Shanghai internal Go module proxy before the Linux/x86 UT job.
• Enable an any-error fallback GOPROXY chain only when the Shanghai runner label is selected and the module endpoint responds successfully.
• Leave GOPROXY unchanged when DNS or HTTP probing fails.
• Time the existing make config and make ut commands without changing their exit behavior.

Why

A recent MatrixOne run spent about 62 minutes in the first package-graph verification on the Shanghai UT runner. The Shanghai SCA job uses the internal module proxy and completed the comparable dependency phase much faster. This canary gathers direct evidence on the UT path while limiting the behavior change to Shanghai runners.

MatrixOne main deliberately uses pipe-separated public proxies so transient timeouts, connection failures, and 5xx responses can fall through. The canary preserves that resilience by exporting:

http://goproxy.goproxy.svc.cluster.local|https://goproxy.cn|direct

Impact

• Shanghai UT probes the internal proxy with a 20-second DNS bound and a 30-second HTTP bound, then exports the fallback chain only after HTTP 200.
• A later error from the internal proxy falls through to goproxy.cn and then direct.
• Other runners retain the existing environment and Makefile proxy behavior; only shell timing output is added.
• Probe failures are warnings and do not fail or skip UT.

Validation

• Parsed the workflow YAML with yq.
• Checked the modified run scripts with bash -n.
• Verified extraction of the first proxy URL from the pipe-separated chain.
• Ran git diff --check.

[aptend]

Blocking: .github/workflows/ci.yaml:125 installs http://goproxy.goproxy.svc.cluster.local,https://goproxy.cn,direct after a single successful Cobra probe. In GOPROXY semantics, a comma advances to the next entry only for HTTP 404/410; a later timeout, connection error, or 5xx from the internal proxy makes go list fail without trying goproxy.cn/direct. The one-module probe cannot establish that every subsequent module request will remain healthy.

This also overrides MatrixOne main's pipe-separated default, which was deliberately changed in matrixorigin/matrixone#26631 to recover from transient proxy failures. Please use an any-error fallback chain here (for example http://goproxy.goproxy.svc.cluster.local|https://goproxy.cn|direct) or otherwise preserve that fallback behavior.

[aptend]

Re-reviewed the full change at 1545fb0. The previous blocker is resolved: the Shanghai proxy chain now uses |, so transient errors from the internal proxy fall through to goproxy.cn/direct, and the probe still extracts the internal endpoint correctly.

I also rechecked the runner condition, go.mod version extraction, DNS/HTTP failure paths, GITHUB_ENV propagation, and time make exit-status behavior. YAML parsing, both modified shell blocks, proxy URL extraction, git diff --check, and the workflow validation check all pass. No remaining blocking issues found.