feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version

cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN,
which ships lsphp85 8.5.0 / lsphp84 8.4.15 (built 2025-12). lsphp only moved
forward as a side effect of installing lsphpNN-ldap. lsphp-apt-upgrade.sh now
sweeps every installed lsphpNN* package (and OS packages) to the repo's current
release on every build and fails the build if the repo is unreachable or the
result doesn't match what CI resolved from the repo index. CI passes a per-run
CACHE_BUST so the upgrade layer is never a cache hit, and images carry
org.whp.php-version / org.whp.lsphp-package-version labels.

Tested on .148 (2026-10-21): cac-lsphp php85/php84 and cac-litespeed php85 built
from this branch report the same PHP (8.5.11 / 8.4.26), identical module lists
and OLS 1.8.4 as the current registry images; with the hardening flags each
serves/runs PHP as the customer uid, restarts, and stops cleanly (exit 0).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile.lsphp

@@ -60,9 +60,20 @@ ARG PHPVER=83
 ## Toolchain layer, deliberately BEFORE the source COPY so editing the extension
 ## does not re-resolve the PHP version (which is what caused the skew above).
 ## Records the exact lsphp version the headers belong to; stage 2 pins to it.
+##
+## lsphp-apt-upgrade.sh (see its header) refuses to run on stale/unreachable
+## repo lists and sweeps every lsphp${PHPVER}* package to the repo's current
+## release. CACHE_BUST is per-CI-run so this layer — and therefore the recorded
+## version stage 2 pins to — is never a cache hit; it is re-declared in stage 2.
+## --no-os-upgrade: this stage is thrown away, OS updates would only cost time.
+## EXPECT_* (CI's repo-index lookup) are asserted here too, so a mismatch fails
+## before the compile rather than after it.
+ARG CACHE_BUST=
+ARG EXPECT_LSPHP_PKG=
+ARG EXPECT_PHP_VERSION=
+COPY ./scripts/lsphp-apt-upgrade.sh /usr/local/sbin/lsphp-apt-upgrade.sh
 RUN set -e; \
-    apt-get update; \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    /usr/local/sbin/lsphp-apt-upgrade.sh --no-os-upgrade "${PHPVER}" \
         build-essential autoconf pkg-config \
         lsphp${PHPVER}-dev; \
     RTV=$(dpkg-query -W -f='${Version}' lsphp${PHPVER}); \
@@ -141,17 +152,29 @@ ENV PHPVER=${PHPVER}
 ## cache hit, new version => this layer re-runs and lands on the same one. The
 ## explicit `=$V` pins then make a mid-build repo roll a LOUD apt failure instead
 ## of a silent skew. Verified satisfiable on PHP 8.1/8.3/8.5 (2026-08-05).
+##
+## SECURITY UPDATES AT BUILD TIME: lsphp-apt-upgrade.sh upgrades the Ubuntu OS
+## packages and every other lsphp${PHPVER}* package (extensions such as -msgpack
+## are NOT dragged along by the -common pin) to the repos' current versions, and
+## fails the build if the repo is unreachable. CACHE_BUST makes this layer a
+## guaranteed cache miss per CI run; EXPECT_* are CI's repo-index lookup,
+## asserted by the script and written into the image labels below.
+ARG CACHE_BUST=
+ARG EXPECT_LSPHP_PKG=
+ARG EXPECT_PHP_VERSION=
 COPY --from=ext-build /build-out/lsphp.version /etc/cac-lsphp-build.version
+COPY ./scripts/lsphp-apt-upgrade.sh /usr/local/sbin/lsphp-apt-upgrade.sh
 RUN set -e; \
     V=$(cat /etc/cac-lsphp-build.version); \
-    apt-get update; \
-    if ! DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    if ! /usr/local/sbin/lsphp-apt-upgrade.sh "${PHPVER}" \
         ca-certificates \
         lsphp${PHPVER}="$V" lsphp${PHPVER}-common="$V" lsphp${PHPVER}-ldap="$V"; then \
-        echo "FATAL: lsphp${PHPVER} $V is what cac_path_parity was compiled against," >&2; \
-        echo "       but the LiteSpeed repo no longer offers it (it keeps only the" >&2; \
-        echo "       current release). The ext-build stage is almost certainly a stale" >&2; \
-        echo "       cache hit — rebuild with --no-cache." >&2; \
+        echo "FATAL: lsphp-apt-upgrade.sh failed (reason above). If apt said" >&2; \
+        echo "       \"Version '$V' ... was not found\" or refused a downgrade: $V is what" >&2; \
+        echo "       cac_path_parity was compiled against, but the LiteSpeed repo (which" >&2; \
+        echo "       keeps only the current release) now offers a newer one — either it" >&2; \
+        echo "       published mid-build or ext-build was a stale cache hit. Re-run the" >&2; \
+        echo "       build (CI) / rebuild with --no-cache (local)." >&2; \
         exit 1; \
     fi; \
     apt-get clean; \
@@ -218,6 +241,14 @@ RUN bash -c 'set -e; \
 ## default so the runuser exec path can't drop it.
 ENV LSPHP_ENABLE_USER_INI=on
 
+## Inspect without running the image:
+##   docker buildx imagetools inspect <ref> --format '{{json .Image.Config.Labels}}'
+## Values come from CI's repo-index lookup and were asserted against the
+## installed packages by lsphp-apt-upgrade.sh above ("unverified" = local build).
+LABEL org.whp.php-version="${EXPECT_PHP_VERSION:-unverified}" \
+      org.whp.lsphp-package-version="${EXPECT_LSPHP_PKG:-unverified}" \
+      org.whp.php-flavour="lsphp${PHPVER}"
+
 EXPOSE 9000
 
 ## TCP-connect + lsphp-alive check (LSAPI isn't FastCGI, so no cgi-fcgi ping).