feat(build): opt-in PKG_CACHE build arg for the internal package cache

Adds scripts/pkg-cache-repos.sh and wires it into Dockerfile,
Dockerfile.fpm, Dockerfile.shared-httpd and Dockerfile.shared-ols. With
--build-arg PKG_CACHE=http://192.168.1.40 (CT130 pkg-cache), dnf/apt go
through the LAN cache. That cache fetches from the Remi/EPEL/AlmaLinux/
Ubuntu/LiteSpeed origins over HTTPS, with fallback tiers and
stale-on-error. Without the arg the script is a no-op and builds are
unchanged.

- rpm: each baseurl becomes "<cache>/<prefix>/... <origin>/...", so dnf
  fails over to the origin if the cache dies mid-build
- every RUN restores the original repo files before it ends, so no
  shipped layer carries the LAN address
- EPEL/Remi release RPMs come from the cache when it is set
- the php.net version gates are untouched

Dockerfile.litespeed/.lsphp are not wired yet (see docs/pkg-cache.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile.shared-ols

@@ -19,6 +19,13 @@ ARG OLS_VERSION=1.8.4
 ARG PHPVER=83
 FROM litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
 
+## OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=http://192.168.1.40
+## (CT130 pkg-cache). Unset = upstream repositories exactly as before. Repo files
+## are restored at the end of every RUN, so no layer keeps the cache address.
+## See scripts/pkg-cache-repos.sh.
+ARG PKG_CACHE=
+COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
+
 ## Tooling the shared tier needs on top of the base:
 ##   - inotify-tools: the .htaccess watcher (spec 5.3)
 ##   - gettext-base: envsubst for render-shared-ols-config.sh
@@ -28,9 +35,11 @@ FROM litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
 ##     liveness check depends on. Only transitively present via the base image
 ##     today (Ubuntu 24.04 pulls it in) — pin it explicitly so it can't be
 ##     pruned as "unused" and silently break the supervisor's crash detection.
-RUN apt-get update && \
+RUN /usr/local/sbin/pkg-cache-repos.sh apt && \
+    apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         inotify-tools gettext-base openssl ca-certificates curl procps && \
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*