Just use Nix.
1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler).
2. Nix has several ways to build OCI images, some even faster to assemble and slimmer output of official Docker tooling.
3. It is allowed several providers for same artefact to resolve pull.
> 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler).
If nix fails to pull things from its binary cache, it will download the "sources" of the derivations, which are hosted in various places and so it's even more likely an overly broad block impacts one of them.
This football block very well could also cover GitHub, cdn.kernel.org, and so on, so nix building things could fail just as easily.
The solution isn't to use something else which can download source code from 100s of sites across the internet to compile as a fallback, it's to not use internet which sporadically blocks sites hosting developer assets.
The solution is not technical, it's political.