build: arch-aware mariadb.repo and lsphp index lookup (amd64 unchanged)

- Dockerfile, Dockerfile.fpm: select rhel$releasever-<amd64|aarch64> from uname -m
  (amd64 file is byte-identical; $basearch cannot be used, x86_64 path 404s).
- scripts/lsphp-repo-version.sh replaces three inline binary-amd64 lookups
  (build-push.yaml x2, lsphp-source-emergency.yaml); arch defaults to amd64.
- fixture test wired into Shell-Checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

scripts/lsphp-repo-version.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+## lsphp-repo-version.sh PHPVER [ARCH] — print the newest lsphpPHPVER package
+## version in LiteSpeed's noble apt index for ARCH (amd64 | arm64; default
+## $LSPHP_ARCH, else amd64, so callers that pass nothing behave as before).
+## The awk/sort pipeline is byte-for-byte the one that used to be inlined in
+## build-push.yaml and lsphp-source-emergency.yaml.
+## Test hook: LSPHP_INDEX_FILE=<path> reads that Packages file instead of curl.
+## Exit 1 (message on stderr) if the arch is unknown or the package is absent.
+set -euo pipefail
+phpver="${1:?usage: lsphp-repo-version.sh PHPVER [ARCH]}"
+arch="${2:-${LSPHP_ARCH:-amd64}}"
+case "$arch" in amd64|arm64) ;; *) echo "unsupported lsphp arch '$arch' (amd64|arm64)" >&2; exit 1 ;; esac
+[[ "$phpver" =~ ^[0-9]+$ ]] || { echo "malformed PHPVER '$phpver'" >&2; exit 1; }
+if [ -n "${LSPHP_INDEX_FILE:-}" ]; then
+    idx=$(cat "$LSPHP_INDEX_FILE")
+else
+    idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 "https://rpms.litespeedtech.com/debian/dists/noble/main/binary-${arch}/Packages")
+fi
+printf '%s\n' "$idx" | awk -v p="lsphp${phpver}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1