ossutil 2.x signs requests with V4 and refuses to run without an explicit region, so the OSS mirror sync would fail in CI even with valid credentials. Derive OSS_REGION from the endpoint host (including -internal variants) and fail fast when it cannot be derived.