ci(security): no ${{ }} in run:, validate resolved versions, LiteSpeed index over HTTPS

Security review of #30: step outputs derived from the LiteSpeed apt index
(fetched over plain HTTP) were spliced into shell via ${{ }} in jobs that
hold registry push secrets — a MITM'd "version" would be shell injection.

- every run: block in build-push.yaml and lsphp-source-emergency.yaml now
  receives matrix values, step outputs, inputs and run_id via env: only
  (incl. the pre-existing php.net / LiteSpeed resolve steps from #24/#29)
- resolved versions are regex-checked before GITHUB_OUTPUT: PHP
  ^[0-9]+\.[0-9]+\.[0-9]+$, deb ^[0-9][0-9A-Za-z.+~:-]*$
- LiteSpeed Packages index fetched over HTTPS (--proto =https); measured
  rpms.litespeedtech.com serves it (HTTP/2 200)
- lsphp-src-build.sh / lsphp-src-overlay.sh validate PHPVER too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/lsphp-src-build.sh

@@ -59,6 +59,7 @@ die() { echo "FATAL(lsphp-src-build): $*" >&2; exit 1; }
 log() { echo "lsphp-src-build: $*"; }
 
 PHPVER="${PHPVER:?PHPVER required}"
+[[ "$PHPVER" =~ ^[0-9]{2}$ ]] || die "PHPVER='$PHPVER' is not NN."
 if [ -z "${PHP_SRC_VERSION:-}" ]; then
     [ -z "${PHP_SRC_SHA256:-}" ] || die "PHP_SRC_SHA256 given without PHP_SRC_VERSION."
     log "PHP_SRC_VERSION empty — packaged lsphp build, nothing to do."

scripts/lsphp-src-overlay.sh

@@ -37,6 +37,7 @@ MODE="${1:?usage: lsphp-src-overlay.sh runtime|dev PHPVER}"
 PHPVER="${2:?usage: lsphp-src-overlay.sh runtime|dev PHPVER}"
 OUT="${3:-/lsphp-src-out}"
 case "$MODE" in runtime|dev) ;; *) echo "FATAL(lsphp-src-overlay): mode must be runtime|dev" >&2; exit 1 ;; esac
+[[ "$PHPVER" =~ ^[0-9]{2}$ ]] || { echo "FATAL(lsphp-src-overlay): PHPVER='$PHPVER' is not NN" >&2; exit 1; }
 
 die() { echo "FATAL(lsphp-src-overlay): $*" >&2; exit 1; }
 log() { echo "lsphp-src-overlay[$MODE]: $*"; }