ci: wire cac-litespeed and cac-lsphp to the package cache and digest-pinned base

Dockerfile.litespeed / Dockerfile.lsphp: one global
ARG BASE_IMAGE=litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
used by every stage (incl. the emergency lsphp-src stage, which stays on
upstream repos). The stages that run lsphp-apt-upgrade.sh (litespeed final,
lsphp ext-build + final) take ARG PKG_CACHE=, ship pkg-cache-repos.sh +
keys/pkg-cache/, and wrap the upgrade in `pkg-cache-repos.sh apt` ...
`pkg-cache-repos.sh restore`. Without PKG_CACHE both are no-ops.

lsphp-apt-upgrade.sh: the madison gate also accepts ${PKG_CACHE}/litespeed/
as the lsphp source, but only when PKG_CACHE is set.

build-push.yaml: Build-LiteSpeed-Images and Build-LSPHP-Images resolve the
base digest directly from Docker Hub, probe the cache, set up buildx with
the registry mirror only for a pinned base, and pass BASE_IMAGE + PKG_CACHE.
OLS_VERSION (1.8.4) is now a job-level env read by both the digest lookup
and the build-arg.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/lsphp-apt-upgrade.sh

@@ -18,7 +18,8 @@
 ## Fails LOUDLY — never ships the base image's PHP by accident:
 ##   * `apt-get update --error-on=any`: plain `apt-get update` only WARNS when a
 ##     repo is unreachable and carries on with no/old lists, exit 0.
-##   * the LiteSpeed repo must be the candidate source for lsphp${PHPVER}.
+##   * the LiteSpeed repo must be the candidate source for lsphp${PHPVER}
+##     (rpms.litespeedtech.com, or ${PKG_CACHE}/litespeed/ when PKG_CACHE is set).
 ##   * after upgrading, no lsphp${PHPVER}* package may remain upgradable.
 ##   * if CI passed the version it resolved from the repo index (EXPECT_LSPHP_PKG,
 ##     EXPECT_PHP_VERSION), the installed package / running PHP must match it;
@@ -52,8 +53,18 @@ echo "lsphp-apt-upgrade: base image lsphp${PHPVER}=$(dpkg-query -W -f='${Version
 # Read each output into a variable and match in the shell: piping into an
 # early-exit reader (grep -q, awk ... exit) under pipefail can SIGPIPE the writer
 # and report "missing" for a package that is there (scripts/tests/lsphp-info-probe.test.sh).
+# With the internal package cache (PKG_CACHE build-arg, scripts/pkg-cache-repos.sh
+# apt) the LiteSpeed source reads ${PKG_CACHE}/litespeed/... instead; that URL is
+# accepted ONLY when PKG_CACHE is set, and only under its /litespeed/ path.
 MADISON=$(apt-cache madison "lsphp${PHPVER}")
-if [[ "$MADISON" != *rpms.litespeedtech.com* ]]; then
+LS_REPO_OK=0
+if [[ "$MADISON" == *rpms.litespeedtech.com* ]]; then
+    LS_REPO_OK=1
+elif [ -n "${PKG_CACHE:-}" ] && [[ "$MADISON" == *"${PKG_CACHE%/}/litespeed/"* ]]; then
+    LS_REPO_OK=1
+    echo "lsphp-apt-upgrade: LiteSpeed repo via package cache ${PKG_CACHE%/}/litespeed/"
+fi
+if [ "$LS_REPO_OK" != 1 ]; then
     apt-cache policy "lsphp${PHPVER}" >&2 || true
     die "the LiteSpeed apt repo does not offer lsphp${PHPVER} (repo missing from sources, or its index is empty)."
 fi