Build 69: fetch nym from our own mirror, not upstream GitHub

Point .github/actions/fetch-nym at git.us-ea.st/GRIN/nym (branch goblin =
upstream nymtech/nym @ b6eb391 + our Android webpki-roots patch) and clone it
directly. Drops both the upstream-GitHub fetch and the git-apply patch step —
the last third-party dependency in the build chain is now self-hosted. Removes
the now-unused ci/nym-webpki-android.patch.

.github/actions/fetch-nym/action.yml

@@ -1,31 +1,23 @@
 name: Fetch patched nym SDK
 description: >
-  Materialize the nym workspace at ../nym (sibling of the goblin checkout) so the
-  `nym-sdk = { path = "../nym/sdk/rust/nym-sdk" }` dependency resolves. We pin the
-  exact upstream commit Goblin was built against and apply Goblin's small
-  Android webpki-roots patch on top — no separate nym fork to maintain.
+  Clone the patched nym workspace from our own mirror
+  (git.us-ea.st/GRIN/nym, branch `goblin` = upstream nymtech/nym @ b6eb391 +
+  Goblin's Android webpki-roots patch) into ../nym, so the
+  `nym-sdk = { path = "../nym/sdk/rust/nym-sdk" }` dependency resolves.
+  Self-hosted: no upstream-GitHub fetch and no patch-apply step.
 
 runs:
   using: composite
   steps:
-    - name: Clone + patch nym
+    - name: Clone patched nym
       shell: bash
       run: |
         set -euo pipefail
-        # Upstream nymtech/nym commit Goblin's Cargo.lock was generated against.
-        NYM_SHA=b6eb391e85be7eb8fca62def6d1ac32fd1108c30
         DEST="$(dirname "$GITHUB_WORKSPACE")/nym"
         if [ -e "$DEST/sdk/rust/nym-sdk/Cargo.toml" ]; then
           echo "nym already present at $DEST"
           exit 0
         fi
         rm -rf "$DEST"
-        mkdir -p "$DEST"
-        cd "$DEST"
-        git init -q
-        git remote add origin https://github.com/nymtech/nym.git
-        # Fetch just the pinned commit (GitHub allows reachable-SHA fetches).
-        git fetch -q --depth 1 origin "$NYM_SHA"
-        git checkout -q FETCH_HEAD
-        git apply --whitespace=nowarn "$GITHUB_WORKSPACE/ci/nym-webpki-android.patch"
-        echo "nym materialized at $DEST ($NYM_SHA + Goblin webpki patch)"
+        git clone --branch goblin --depth 1 https://git.us-ea.st/GRIN/nym.git "$DEST"
+        echo "nym cloned from GRIN/nym@goblin -> $DEST"