install-node.sh no longer runs `curl https://rpm.nodesource.com/setup_N.x | bash` (an unverified remote script). `pkg-cache-repos.sh nodesource N` writes the same nodesource-nodejs repo (origin URL in the shipped image, gpgcheck=1) with the signing key committed in keys/pkg-cache/RPM-GPG-KEY-nodesource. With PKG_CACHE the repo goes through the internal cache (https://192.168.1.40/nodesource/, origin as 2nd baseurl) and the RUN restores the origin files at the end. The unused N|Solid repo (18/20/22) is no longer added. pkg-cache-repos.sh + keys/pkg-cache synced byte-identical from cloud-apache-container branch ci/pkg-cache-more-upstreams (canonical). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>