feat(build): opt-in PKG_CACHE build arg for the internal package cache

Adds scripts/pkg-cache-repos.sh and wires it into Dockerfile,
Dockerfile.fpm, Dockerfile.shared-httpd and Dockerfile.shared-ols. With
--build-arg PKG_CACHE=http://192.168.1.40 (CT130 pkg-cache), dnf/apt go
through the LAN cache. That cache fetches from the Remi/EPEL/AlmaLinux/
Ubuntu/LiteSpeed origins over HTTPS, with fallback tiers and
stale-on-error. Without the arg the script is a no-op and builds are
unchanged.

- rpm: each baseurl becomes "<cache>/<prefix>/... <origin>/...", so dnf
  fails over to the origin if the cache dies mid-build
- every RUN restores the original repo files before it ends, so no
  shipped layer carries the LAN address
- EPEL/Remi release RPMs come from the cache when it is set
- the php.net version gates are untouched

Dockerfile.litespeed/.lsphp are not wired yet (see docs/pkg-cache.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -7,10 +7,15 @@ ARG CACHE_BUST=
 # php.net's current release for this branch (CI); the build fails on older PHP.
 ARG EXPECT_PHP_MIN=
 
+# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=http://192.168.1.40
+# (CT130 pkg-cache). Unset = upstream repositories exactly as before. Repo files
+# are restored at the end of every RUN, so no layer keeps the cache address.
+# See scripts/pkg-cache-repos.sh.
+ARG PKG_CACHE=
+COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
 # Install repos, update, install only needed packages, clean up in one layer
-RUN dnf install -y \
-      https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \
-      https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \
+RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
+    dnf install -y $(/usr/local/sbin/pkg-cache-repos.sh release-urls) && \
     # Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security
     # release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out),
     # so builds shipped unpatched PHP. HTTPS first; plain http only as a fallback
@@ -18,10 +23,12 @@ RUN dnf install -y \
     # replayed (old) http index can't ship old PHP: packages stay GPG-checked and
     # the EXPECT_PHP_MIN gate below fails the build on anything older than php.net.
     sed -i -e 's|^#baseurl=http://\(.*\)$|baseurl=https://\1 http://\1|' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \
+    /usr/local/sbin/pkg-cache-repos.sh rpm && \
     printf 'retries=10\ntimeout=60\n' >> /etc/dnf/dnf.conf && \
     dnf update -y && \
     dnf install -y httpd mod_ssl openssl wget procps cronie iproute postgresql-devel microdnf less git \
       nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix && \
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
     dnf clean all && \
     rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/*
 
@@ -30,13 +37,17 @@ COPY ./scripts/ /scripts/
 RUN chmod +x /scripts/*
 
 # Install ImageMagick from EPEL with HEIC/HEIF/AVIF support
-RUN dnf install -y ImageMagick ImageMagick-libs ImageMagick-heic && \
+RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
+    dnf install -y ImageMagick ImageMagick-libs ImageMagick-heic && \
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
     dnf clean all
 
 # Generate self-signed cert, create needed dirs, install PHP, clean up
 RUN openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/localhost.key -x509 -days 3650 -subj "/CN=localhost" -out /etc/pki/tls/certs/localhost.crt && \
     mkdir -p /run/php-fpm/ && \
+    /usr/local/sbin/pkg-cache-repos.sh rpm && \
     /scripts/install-php$PHPVER.sh && \
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
     # CI passes php.net's current release for the branch; never ship older PHP.
     if [ -n "$EXPECT_PHP_MIN" ]; then \
       php -r 'exit(version_compare(PHP_VERSION, getenv("EXPECT_PHP_MIN"), ">=") ? 0 : 1);' || \