ci: wire cac-litespeed and cac-lsphp to the package cache and digest-pinned base

Dockerfile.litespeed / Dockerfile.lsphp: one global
ARG BASE_IMAGE=litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
used by every stage (incl. the emergency lsphp-src stage, which stays on
upstream repos). The stages that run lsphp-apt-upgrade.sh (litespeed final,
lsphp ext-build + final) take ARG PKG_CACHE=, ship pkg-cache-repos.sh +
keys/pkg-cache/, and wrap the upgrade in `pkg-cache-repos.sh apt` ...
`pkg-cache-repos.sh restore`. Without PKG_CACHE both are no-ops.

lsphp-apt-upgrade.sh: the madison gate also accepts ${PKG_CACHE}/litespeed/
as the lsphp source, but only when PKG_CACHE is set.

build-push.yaml: Build-LiteSpeed-Images and Build-LSPHP-Images resolve the
base digest directly from Docker Hub, probe the cache, set up buildx with
the registry mirror only for a pinned base, and pass BASE_IMAGE + PKG_CACHE.
OLS_VERSION (1.8.4) is now a job-level env read by both the digest lookup
and the build-arg.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile.lsphp

@@ -21,6 +21,12 @@
 
 ARG OLS_VERSION=1.8.4
 ARG PHPVER=83
+## CI passes BASE_IMAGE=litespeedtech/openlitespeed@sha256:<digest> of the
+## ${OLS_VERSION}-lsphp${PHPVER} tag, resolved DIRECTLY from Docker Hub in the same
+## run (.gitea/scripts/resolve-base-image.sh), so the pkg-cache registry mirror can
+## only serve content-addressed blobs. Local builds use the tag. Every stage below
+## (incl. the emergency lsphp-src stage) starts from this one image.
+ARG BASE_IMAGE=litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
 
 ## ---- stage 0 (EMERGENCY ONLY): lsphp compiled from php.net source -----------
 ## Idle unless PHP_SRC_VERSION is set: lsphp-src-build.sh then exits at once and
@@ -30,7 +36,7 @@ ARG PHPVER=83
 ## — CI: .gitea/workflows/lsphp-source-emergency.yaml; runbook:
 ## docs/lsphp-source-emergency.md. The tarball is sha256- AND OpenPGP-verified
 ## against keys/php-src/; configure flags are replayed from the packaged lsphp.
-FROM litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER} AS lsphp-src
+FROM ${BASE_IMAGE} AS lsphp-src
 ARG PHPVER=83
 ARG CACHE_BUST=
 ARG EXPECT_LSPHP_PKG=
@@ -77,7 +83,7 @@ RUN --mount=type=bind,source=scripts,target=/mnt/scripts \
 ## Separate stage on purpose: the compiler + headers (~400MB) stay out of the
 ## shipped image, which gains only the ~40KB .so. Costs ~1-2 min of CI per PHP
 ## version; both stages share the same base layer, so no extra pull.
-FROM litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER} AS ext-build
+FROM ${BASE_IMAGE} AS ext-build
 ARG PHPVER=83
 
 ## Toolchain layer, deliberately BEFORE the source COPY so editing the extension
@@ -94,11 +100,20 @@ ARG PHPVER=83
 ARG CACHE_BUST=
 ARG EXPECT_LSPHP_PKG=
 ARG EXPECT_PHP_VERSION=
+## OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
+## (CT130 pkg-cache, https only). Unset = upstream repositories (Ubuntu +
+## rpms.litespeedtech.com). Repo files are restored at the end of the RUN, so no
+## layer keeps the cache address. See scripts/pkg-cache-repos.sh.
+ARG PKG_CACHE=
+COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
+COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
 COPY ./scripts/lsphp-apt-upgrade.sh /usr/local/sbin/lsphp-apt-upgrade.sh
 RUN set -e; \
+    /usr/local/sbin/pkg-cache-repos.sh apt; \
     /usr/local/sbin/lsphp-apt-upgrade.sh --no-os-upgrade "${PHPVER}" \
         build-essential autoconf pkg-config \
         lsphp${PHPVER}-dev; \
+    /usr/local/sbin/pkg-cache-repos.sh restore; \
     RTV=$(dpkg-query -W -f='${Version}' lsphp${PHPVER}); \
     DEVV=$(dpkg-query -W -f='${Version}' lsphp${PHPVER}-dev); \
     if [ "$RTV" != "$DEVV" ]; then \
@@ -168,7 +183,7 @@ RUN set -e; \
     cp modules/cac_path_parity.so /build-out/
 
 ## ---- stage 2: the shipped sidecar image ------------------------------------
-FROM litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
+FROM ${BASE_IMAGE}
 ARG PHPVER=83
 ENV PHPVER=${PHPVER}
 
@@ -196,10 +211,18 @@ ENV PHPVER=${PHPVER}
 ARG CACHE_BUST=
 ARG EXPECT_LSPHP_PKG=
 ARG EXPECT_PHP_VERSION=
+## OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
+## (CT130 pkg-cache, https only). Unset = upstream repositories (Ubuntu +
+## rpms.litespeedtech.com). Repo files are restored at the end of the RUN, so no
+## layer keeps the cache address. See scripts/pkg-cache-repos.sh.
+ARG PKG_CACHE=
+COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
+COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
 COPY --from=ext-build /build-out/lsphp.version /etc/cac-lsphp-build.version
 COPY ./scripts/lsphp-apt-upgrade.sh /usr/local/sbin/lsphp-apt-upgrade.sh
 RUN set -e; \
     V=$(cat /etc/cac-lsphp-build.version); \
+    /usr/local/sbin/pkg-cache-repos.sh apt; \
     if ! /usr/local/sbin/lsphp-apt-upgrade.sh "${PHPVER}" \
         ca-certificates \
         lsphp${PHPVER}="$V" lsphp${PHPVER}-common="$V" lsphp${PHPVER}-ldap="$V"; then \
@@ -211,6 +234,7 @@ RUN set -e; \
         echo "       build (CI) / rebuild with --no-cache (local)." >&2; \
         exit 1; \
     fi; \
+    /usr/local/sbin/pkg-cache-repos.sh restore; \
     apt-get clean; \
     rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*; \
     RTV=$(dpkg-query -W -f='${Version}' lsphp${PHPVER}); \