fix(ci): build through the internal package cache; keep bundled npm on Node 18/20

- The first Node 24/26 run timed out on every job: public AlmaLinux mirrors
  served the runners at 1-150 kB/s. Use the CT130 package cache the same way
  cloud-apache-container does (same pkg-cache-repos.sh and pinned CA), with
  the upstream repos as fallback when the probe fails. epel-release is now
  GPG-verified before install instead of fetched unverified by URL.
- npm 12 requires Node >=22.22.2; on 18/20 keep the npm Node ships with.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/install-node.sh

@@ -18,7 +18,9 @@ declare -A MIN=(
 
 wget -qO- "https://rpm.nodesource.com/setup_${major}.x" | bash -
 dnf install -y nodejs
-npm install -g npm@latest
+# npm 12 dropped Node 18/20; on those lines keep the npm Node ships with
+# (what the old per-version scripts did, silently, before this one failed hard).
+npm install -g npm@latest || echo "WARNING: npm@latest does not support Node $major; keeping bundled npm $(npm --version)" >&2
 
 have="$(node -p 'process.versions.node')"
 case "$have" in "$major".*) ;; *) echo "ERROR: wanted Node $major, got $have" >&2; exit 1;; esac