fix(ci): build through the internal package cache; keep bundled npm on Node 18/20

- The first Node 24/26 run timed out on every job: public AlmaLinux mirrors
  served the runners at 1-150 kB/s. Use the CT130 package cache the same way
  cloud-apache-container does (same pkg-cache-repos.sh and pinned CA), with
  the upstream repos as fallback when the probe fails. epel-release is now
  GPG-verified before install instead of fetched unverified by URL.
- npm 12 requires Node >=22.22.2; on 18/20 keep the npm Node ships with.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -16,10 +16,38 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # Internal package cache (CT130 pkg-cache). Used ONLY if it answers over
+      # TLS with our pinned CA; otherwise this job builds from the upstream repos
+      # and Docker Hub exactly as before. Repo cache and registry mirror are
+      # probed separately so either can fail back on its own.
+      - name: Probe package cache
+        id: pkgcache
+        run: |
+          url=""; mirror=""
+          if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
+          if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
+          echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<unreachable: Docker Hub>}"
+          [ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
+          echo "url=${url}" >> "$GITHUB_OUTPUT"
+          echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
+      # BuildKit ignores dockerd's registry-mirrors, so the mirror is set on the
+      # builder; BuildKit still falls back to Docker Hub if the mirror stops.
+      - name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
+        if: steps.pkgcache.outputs.mirror != ''
+        uses: docker/setup-buildx-action@v3
+        with:
+          buildkitd-config-inline: |
+            [registry."docker.io"]
+              mirrors = ["192.168.1.40:5000"]
+            [registry."192.168.1.40:5000"]
+              ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
+
       - name: Set up Docker Buildx
+        if: steps.pkgcache.outputs.mirror == ''
         uses: docker/setup-buildx-action@v3
 
       - name: Login to Gitea
@@ -36,6 +64,7 @@ jobs:
           push: true
           build-args: |
             NODEVER=${{ matrix.nodever }}
+            PKG_CACHE=${{ steps.pkgcache.outputs.url }}
           tags: |
             repo.anhonesthost.net/cloud-hosting-platform/cnoc:node${{ matrix.nodever }}
             ${{ matrix.nodever == '20' && 'repo.anhonesthost.net/cloud-hosting-platform/cnoc:latest' || '' }}