ci: stop building PHP 7.4, 8.0 and 8.1 images

All four image matrices (cac, cac-fpm, cac-litespeed, cac-lsphp) and the
emergency lsphp-from-source workflow now build PHP 8.2-8.5 only. 7.4-8.1 are
end of life and got no upstream fix for CVE-2026-109618/109619; no fleet site
runs them any more. Existing :php74/:php80/:php81 tags stay in the registry
but are no longer rebuilt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -80,7 +80,7 @@ jobs:
       # security builds of the others.
       fail-fast: false
       matrix:
-        phpver: [74, 80, 81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -178,7 +178,7 @@ jobs:
       # security builds of the others.
       fail-fast: false
       matrix:
-        phpver: [74, 80, 81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -281,7 +281,7 @@ jobs:
         # images stop at older OLS releases for those PHP versions, and the
         # cac-litespeed tier is a paid premium offering: 8.1+ is the
         # modernization story we're selling.
-        phpver: [81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -364,10 +364,9 @@ jobs:
             CACHE_BUST=${{ steps.bust.outputs.value }}
             EXPECT_LSPHP_PKG=${{ steps.lsphp.outputs.pkg }}
             EXPECT_PHP_VERSION=${{ steps.lsphp.outputs.php }}
-          # OLS_VERSION pinned to 1.8.4 — only release with prebuilt images
-          # for every PHP version we ship (1.8.5 and 1.9.0 don't have an
-          # lsphp81 variant on Docker Hub). Bump alongside a local rebuild
-          # test when LiteSpeed publishes lsphp81 on a newer OLS release.
+          # OLS_VERSION pinned to 1.8.4. It was the only release with an lsphp81
+          # variant; 8.1 and older are no longer built (2026-10-21), so the pin
+          # can move to a newer OLS release after a local rebuild test.
           # See spec: docs/superpowers/specs/2026-06-01-cac-litespeed-design.md
           tags: |
             repo.anhonesthost.net/cloud-hosting-platform/cac-litespeed:php${{ matrix.phpver }}
@@ -384,7 +383,7 @@ jobs:
         # backend for the shared-ols tier and shares the litespeed prebuilt
         # base, which only ships lsphp for 8.1+. Keep this matrix in lockstep
         # with Build-LiteSpeed-Images.
-        phpver: [81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.gitea/workflows/lsphp-source-emergency.yaml

@@ -39,7 +39,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        phpver: [81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
         image: [lsphp, litespeed]
     steps:
       - name: Select this job's target (skip if not requested)
@@ -57,7 +57,7 @@ jobs:
           case "$IN_PROD" in true|false) ;; *) echo "::error::push_production_tags must be true|false, got '$IN_PROD'"; exit 1 ;; esac
           v=""
           for pair in $IN_VERSIONS; do
-            [[ "$pair" =~ ^(8[1-5])=([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { echo "::error::bad php_versions entry '$pair' (want NN=X.Y.Z, NN in 81..85)"; exit 1; }
+            [[ "$pair" =~ ^(8[2-5])=([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { echo "::error::bad php_versions entry '$pair' (want NN=X.Y.Z, NN in 82..85)"; exit 1; }
             [ "${BASH_REMATCH[1]}" = "$PHPVER" ] && v="${BASH_REMATCH[2]}"
           done
           echo "prod=$IN_PROD" >> "$GITHUB_OUTPUT"