fix(build): NodeSource repo via pkg-cache-repos.sh (pinned key, cache-aware)

install-node.sh no longer runs `curl https://rpm.nodesource.com/setup_N.x | bash`
(an unverified remote script). `pkg-cache-repos.sh nodesource N` writes the same
nodesource-nodejs repo (origin URL in the shipped image, gpgcheck=1) with the
signing key committed in keys/pkg-cache/RPM-GPG-KEY-nodesource. With PKG_CACHE
the repo goes through the internal cache (https://192.168.1.40/nodesource/,
origin as 2nd baseurl) and the RUN restores the origin files at the end.
The unused N|Solid repo (18/20/22) is no longer added.

pkg-cache-repos.sh + keys/pkg-cache synced byte-identical from
cloud-apache-container branch ci/pkg-cache-more-upstreams (canonical).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

keys/pkg-cache/README

@@ -11,3 +11,22 @@ RPM-GPG-KEY-EPEL-10    Fedora (epel10) 7D8D 15CB FC4E 6268 8591 FB26 33D9 8517 E
                        fetched 2026-10-21 over HTTPS from dl.fedoraproject.org and
                        mirror.math.princeton.edu (identical); fingerprint matches
                        https://fedoraproject.org/security/
+RPM-GPG-KEY-remi2024   Remi's RPM repository 2024 CF1D F005 7CE8 5DFF 5B2F 2A37 C2FD 3B2C 2A09 48E4
+                       fetched 2026-10-21 over HTTPS from rpms.remirepo.net; byte-identical
+                       to the key shipped in remi-release-10.2-1.el10.remi. Not found on
+                       keys.openpgp.org / keyserver.ubuntu.com - confirm out of band.
+                       Remi rotates keys (remi2025, ...): when remi-release starts being
+                       signed by a new key, `release-install remi` fails loudly - add the
+                       new key here (and to pkg-cache-repos.sh).
+RPM-GPG-KEY-EPEL-9     Fedora (epel9) FF8A D134 4597 106E CE81 3B91 8A38 72BF 3228 467C
+                       fetched 2026-10-22 over HTTPS from dl.fedoraproject.org and
+                       mirror.math.princeton.edu (identical); used by `release-install epel`
+                       on EL9 images (cloud-memcached-container, cloud-haproxy-container).
+RPM-GPG-KEY-nodesource Nodesource Operations <operations@nodesource.com>
+                       242B 8138 31AF 0956 2B6C 46F7 6B88 DA4E 3AF2 8A14 (rsa4096, 2023-12-22)
+                       fetched 2026-10-22 over HTTPS from
+                       https://rpm.nodesource.com/gpgkey/ns-operations-public.key (the key
+                       NodeSource's own setup_N.x scripts reference); verified by dnf
+                       gpgcheck against the nodejs RPMs. Not on keys.openpgp.org /
+                       keyserver.ubuntu.com - confirm out of band. Used by
+                       `pkg-cache-repos.sh nodesource MAJOR` (cloud-node-container).