build: arch-aware mariadb.repo and lsphp index lookup (amd64 unchanged)

- Dockerfile, Dockerfile.fpm: select rhel$releasever-<amd64|aarch64> from uname -m
  (amd64 file is byte-identical; $basearch cannot be used, x86_64 path 404s).
- scripts/lsphp-repo-version.sh replaces three inline binary-amd64 lookups
  (build-push.yaml x2, lsphp-source-emergency.yaml); arch defaults to amd64.
- fixture test wired into Shell-Checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

scripts/lsphp-repo-version.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+## lsphp-repo-version.sh PHPVER [ARCH] — print the newest lsphpPHPVER package
+## version in LiteSpeed's noble apt index for ARCH (amd64 | arm64; default
+## $LSPHP_ARCH, else amd64, so callers that pass nothing behave as before).
+## The awk/sort pipeline is byte-for-byte the one that used to be inlined in
+## build-push.yaml and lsphp-source-emergency.yaml.
+## Test hook: LSPHP_INDEX_FILE=<path> reads that Packages file instead of curl.
+## Exit 1 (message on stderr) if the arch is unknown or the package is absent.
+set -euo pipefail
+phpver="${1:?usage: lsphp-repo-version.sh PHPVER [ARCH]}"
+arch="${2:-${LSPHP_ARCH:-amd64}}"
+case "$arch" in amd64|arm64) ;; *) echo "unsupported lsphp arch '$arch' (amd64|arm64)" >&2; exit 1 ;; esac
+[[ "$phpver" =~ ^[0-9]+$ ]] || { echo "malformed PHPVER '$phpver'" >&2; exit 1; }
+if [ -n "${LSPHP_INDEX_FILE:-}" ]; then
+    idx=$(cat "$LSPHP_INDEX_FILE")
+else
+    idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 "https://rpms.litespeedtech.com/debian/dists/noble/main/binary-${arch}/Packages")
+fi
+printf '%s\n' "$idx" | awk -v p="lsphp${phpver}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1

scripts/tests/lsphp-repo-version.test.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+## lsphp-repo-version.test.sh — fixture test for scripts/lsphp-repo-version.sh.
+## Asserts: amd64 (explicit and default) equals the OLD inline pipeline on the
+## same fixture; arm64 picks from the arm64 index (fixtures deliberately differ);
+## bad arch is refused.
+set -euo pipefail
+HERE=$(cd "$(dirname "$0")/.." && pwd)
+S="$HERE/lsphp-repo-version.sh"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+mk() { # file, version-for-lsphp85
+cat >"$T/$1" <<EOT
+Package: lsphp84
+Version: 8.4.20-1+ubuntu24.04.1+deb.sury.org+1
+Architecture: x
+
+Package: lsphp85
+Version: 8.5.1-1+ubuntu24.04.1+deb.sury.org+1
+Architecture: x
+
+Package: lsphp85
+Version: $2
+Architecture: x
+
+Package: lsphp85-common
+Version: 9.9.9-1
+Architecture: x
+EOT
+}
+mk amd64.Packages 8.5.12-1+ubuntu24.04.1+deb.sury.org+1
+mk arm64.Packages 8.5.11-1+ubuntu24.04.1+deb.sury.org+1
+old() { printf '%s\n' "$(cat "$1")" | awk -v p="lsphp${2}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1; }
+fail=0
+chk() { if [ "$2" = "$3" ]; then echo "ok   $1: $2"; else echo "FAIL $1: got '$2' want '$3'"; fail=1; fi; }
+for v in 84 85; do
+  chk "amd64 explicit lsphp$v == old inline" "$(LSPHP_INDEX_FILE=$T/amd64.Packages "$S" $v amd64)" "$(old "$T/amd64.Packages" $v)"
+  chk "default arch lsphp$v == old inline"   "$(LSPHP_INDEX_FILE=$T/amd64.Packages "$S" $v)" "$(old "$T/amd64.Packages" $v)"
+done
+chk "arm64 reads arm64 index" "$(LSPHP_INDEX_FILE=$T/arm64.Packages "$S" 85 arm64)" "8.5.11-1+ubuntu24.04.1+deb.sury.org+1"
+chk "LSPHP_ARCH env" "$(LSPHP_ARCH=arm64 LSPHP_INDEX_FILE=$T/arm64.Packages "$S" 85)" "8.5.11-1+ubuntu24.04.1+deb.sury.org+1"
+chk "missing pkg is empty" "$(LSPHP_INDEX_FILE=$T/amd64.Packages "$S" 99)" ""
+if "$S" 85 s390x >/dev/null 2>&1; then echo "FAIL bad arch accepted"; fail=1; else echo "ok   bad arch refused"; fi
+exit $fail