feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version

cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN,
which ships lsphp85 8.5.0 / lsphp84 8.4.15 (built 2025-12). lsphp only moved
forward as a side effect of installing lsphpNN-ldap. lsphp-apt-upgrade.sh now
sweeps every installed lsphpNN* package (and OS packages) to the repo's current
release on every build and fails the build if the repo is unreachable or the
result doesn't match what CI resolved from the repo index. CI passes a per-run
CACHE_BUST so the upgrade layer is never a cache hit, and images carry
org.whp.php-version / org.whp.lsphp-package-version labels.

Tested on .148 (2026-10-21): cac-lsphp php85/php84 and cac-litespeed php85 built
from this branch report the same PHP (8.5.11 / 8.4.26), identical module lists
and OLS 1.8.4 as the current registry images; with the hardening flags each
serves/runs PHP as the customer uid, restarts, and stops cleanly (exit 0).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile.fpm

@@ -1,5 +1,9 @@
 FROM almalinux/10-base
 ARG PHPVER=83
+# Per-CI-run value: the first RUN below (dnf update) and everything after it can
+# never be a layer-cache hit, so every build gets the repos' current packages.
+# Local builds: --build-arg CACHE_BUST=$(date +%s) or --no-cache.
+ARG CACHE_BUST=
 
 # Install repos, update, install only needed packages (no httpd/mod_ssl), clean up in one layer
 RUN dnf install -y \
@@ -22,6 +26,7 @@ RUN dnf install -y ImageMagick ImageMagick-libs ImageMagick-heic && \
 # Create needed dirs, install PHP, clean up (no SSL cert, no httpd)
 RUN mkdir -p /run/php-fpm/ && \
     /scripts/install-php$PHPVER.sh && \
+    echo "PHP version report:" && php -v && rpm -q php-cli php-common php-fpm && \
     rm -rf /tmp/*
 
 # Download and install wp-cli