Mirror chain: +xuanyuan/dockerhub.icu (CN) + mirror.gcr.io/public.ecr (intl)

16 total. The intl entries need real egress (usually blocked on this
host) but cost only 10s each with the idle watchdog on networks that
have them. Also noted: a 10s watchdog can kill sources mid slow
negotiation (rat.dev emitted 'Pulling fs layer' then went quiet) --
EVALHARNESS_PULL_IDLE_S=30 softens that.

Co-Authored-By: Claude <noreply@anthropic.com>

evalharness/sandbox/prefetch.py

@@ -19,12 +19,18 @@ from ..data.dataset import Dataset
 # CN mirrors tried in order before/alongside the daemon's configured mirrors.
 # Some namespaces (e.g. swebench/*) are blocked by individual CN mirrors, so we
 # fall through: daemon default -> 1ms.run -> baidubce -> sjtug.
+# CN + international mainstream fallbacks. History on this host: daocloud
+# (139s) and 1ms.run (342s + trickle) have delivered this 9GB image; the
+# international entries (Google's hub cache, AWS ECR public) need real
+# egress -- usually blocked here, kept for networks that have it.
 _CN_MIRROR_FALLBACKS = [
     '{img}',  # daemon default (uses its own registry-mirrors config)
     'docker.m.daocloud.io/{img}',
     'docker.1ms.run/{img}',
     'docker.1panel.live/{img}',
     'hub.rat.dev/{img}',
+    'docker.xuanyuan.me/{img}',
+    'dockerhub.icu/{img}',
     'dockerproxy.com/{img}',
     'hub-mirror.c.163.com/{img}',
     'mirror.baidubce.com/{img}',
@@ -32,6 +38,8 @@ _CN_MIRROR_FALLBACKS = [
     'docker.mirrors.sjtug.sjtu.edu.cn/{img}',
     'docker.nju.edu.cn/{img}',
     'docker.mirrors.tuna.tsinghua.edu.cn/{img}',
+    'mirror.gcr.io/{img}',       # Google's docker-hub cache (intl)
+    'public.ecr.aws/docker/{img}',  # AWS ECR public (library/* coverage)
 ]
 # 用户/环境可整体覆盖（逗号分隔模板，{img} 占位）
 import os as _os