fix(build): NodeSource repo via pkg-cache-repos.sh (pinned key, cache-aware)

install-node.sh no longer runs `curl https://rpm.nodesource.com/setup_N.x | bash`
(an unverified remote script). `pkg-cache-repos.sh nodesource N` writes the same
nodesource-nodejs repo (origin URL in the shipped image, gpgcheck=1) with the
signing key committed in keys/pkg-cache/RPM-GPG-KEY-nodesource. With PKG_CACHE
the repo goes through the internal cache (https://192.168.1.40/nodesource/,
origin as 2nd baseurl) and the RUN restores the origin files at the end.
The unused N|Solid repo (18/20/22) is no longer added.

pkg-cache-repos.sh + keys/pkg-cache synced byte-identical from
cloud-apache-container branch ci/pkg-cache-more-upstreams (canonical).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/install-node.sh

@@ -16,7 +16,12 @@ declare -A MIN=(
   [26]=26.12.1
 )
 
-wget -qO- "https://rpm.nodesource.com/setup_${major}.x" | bash -
+# NodeSource repo written by pkg-cache-repos.sh with the signing key committed
+# in keys/pkg-cache/ (replaces `curl setup_N.x | bash`, an unverified remote
+# script). With PKG_CACHE (CI, cache reachable) the repo goes through the
+# internal cache with the origin as 2nd baseurl; the caller's RUN must end with
+# `pkg-cache-repos.sh restore`. RPMs are GPG-checked either way.
+/usr/local/sbin/pkg-cache-repos.sh nodesource "$major"
 dnf install -y nodejs
 # npm 12 dropped Node 18/20; on those lines keep the npm Node ships with
 # (what the old per-version scripts did, silently, before this one failed hard).