ci: stop building PHP 7.4, 8.0 and 8.1 images

All four image matrices (cac, cac-fpm, cac-litespeed, cac-lsphp) and the
emergency lsphp-from-source workflow now build PHP 8.2-8.5 only. 7.4-8.1 are
end of life and got no upstream fix for CVE-2026-109618/109619; no fleet site
runs them any more. Existing :php74/:php80/:php81 tags stay in the registry
but are no longer rebuilt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -80,7 +80,7 @@ jobs:
       # security builds of the others.
       fail-fast: false
       matrix:
-        phpver: [74, 80, 81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -178,7 +178,7 @@ jobs:
       # security builds of the others.
       fail-fast: false
       matrix:
-        phpver: [74, 80, 81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -281,7 +281,7 @@ jobs:
         # images stop at older OLS releases for those PHP versions, and the
         # cac-litespeed tier is a paid premium offering: 8.1+ is the
         # modernization story we're selling.
-        phpver: [81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -364,10 +364,9 @@ jobs:
             CACHE_BUST=${{ steps.bust.outputs.value }}
             EXPECT_LSPHP_PKG=${{ steps.lsphp.outputs.pkg }}
             EXPECT_PHP_VERSION=${{ steps.lsphp.outputs.php }}
-          # OLS_VERSION pinned to 1.8.4 — only release with prebuilt images
-          # for every PHP version we ship (1.8.5 and 1.9.0 don't have an
-          # lsphp81 variant on Docker Hub). Bump alongside a local rebuild
-          # test when LiteSpeed publishes lsphp81 on a newer OLS release.
+          # OLS_VERSION pinned to 1.8.4. It was the only release with an lsphp81
+          # variant; 8.1 and older are no longer built (2026-10-21), so the pin
+          # can move to a newer OLS release after a local rebuild test.
           # See spec: docs/superpowers/specs/2026-06-01-cac-litespeed-design.md
           tags: |
             repo.anhonesthost.net/cloud-hosting-platform/cac-litespeed:php${{ matrix.phpver }}
@@ -384,7 +383,7 @@ jobs:
         # backend for the shared-ols tier and shares the litespeed prebuilt
         # base, which only ships lsphp for 8.1+. Keep this matrix in lockstep
         # with Build-LiteSpeed-Images.
-        phpver: [81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.gitea/workflows/lsphp-source-emergency.yaml

@@ -39,7 +39,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        phpver: [81, 82, 83, 84, 85]
+        phpver: [82, 83, 84, 85]
         image: [lsphp, litespeed]
     steps:
       - name: Select this job's target (skip if not requested)
@@ -57,7 +57,7 @@ jobs:
           case "$IN_PROD" in true|false) ;; *) echo "::error::push_production_tags must be true|false, got '$IN_PROD'"; exit 1 ;; esac
           v=""
           for pair in $IN_VERSIONS; do
-            [[ "$pair" =~ ^(8[1-5])=([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { echo "::error::bad php_versions entry '$pair' (want NN=X.Y.Z, NN in 81..85)"; exit 1; }
+            [[ "$pair" =~ ^(8[2-5])=([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { echo "::error::bad php_versions entry '$pair' (want NN=X.Y.Z, NN in 82..85)"; exit 1; }
             [ "${BASH_REMATCH[1]}" = "$PHPVER" ] && v="${BASH_REMATCH[2]}"
           done
           echo "prod=$IN_PROD" >> "$GITHUB_OUTPUT"

scripts/pkg-cache-repos.sh

@@ -83,13 +83,17 @@ created() { printf '%s\n' "$1" >> "$STATE/created"; }
 if [ "$MODE" = restore ]; then
     [ -d "$STATE" ] || exit 0
     host=$(cat "$STATE/host")
-    (cd "$STATE/orig" && find . -type f) | while read -r rel; do
+    # mapfile from a process substitution, not `cmd | while read`: no pipeline,
+    # so nothing for pipefail to misreport (scripts/tests/lsphp-info-probe.test.sh).
+    mapfile -t saved < <(cd "$STATE/orig" && find . -type f)
+    for rel in "${saved[@]}"; do
         cat "$STATE/orig/$rel" > "/${rel#./}"
     done
     while read -r f; do [ -n "$f" ] && rm -f -- "$f"; done < "$STATE/created"
     # A repo/apt file that appeared during this RUN and still names the cache
     # (e.g. written by a package from the rewritten repos) is removed too.
-    repo_files | while read -r f; do
+    mapfile -t current < <(repo_files)
+    for f in "${current[@]}"; do
         if ! grep -qxF -- "$f" "$STATE/manifest" && grep -qF -- "$host" "$f"; then
             echo "pkg-cache-repos: removing new file that references the cache: $f"
             rm -f -- "$f"