ci: build through the internal package cache; mirror bases by Docker Hub digest (2026.10.7)

- Dockerfile: optional ARG PKG_CACHE; the apt RUN (dist-upgrade + pinned
  haproxy) rewrites sources via scripts/pkg-cache-repos.sh apt and restores
  them before the RUN ends. Without PKG_CACHE: upstream Debian, as before.
- coraza-spoa/Dockerfile: same for the build stage's apt RUN; go mod
  download / go build (build + catalog stages) use go-env (GOPROXY via the
  cache with proxy.golang.org fallback; GOSUMDB unchanged) and restore.
  Build context is ./coraza-spoa, so coraza-spoa/scripts/pkg-cache-repos.sh
  and coraza-spoa/keys/pkg-cache/ are byte-identical copies of the root ones.
- build-push.yaml / build-push-coraza.yaml: "Probe package cache" step
  (TLS with the pinned CA), PKG_CACHE build-arg. Bases come from
  repo.anhonesthost.net / gcr.io, not docker.io: registry mirror not used.
- mirror-base-image.yaml: resolve the tag's digest directly at Docker Hub
  (.gitea/scripts/resolve-base-image.sh) and pull docker.io/library/<img>@sha256
  so the mirrored content is exactly the digest Docker Hub reported; same
  destination tags. Values reach run: via env only.
- Canonical copies (byte-identical) of scripts/pkg-cache-repos.sh,
  .gitea/scripts/resolve-base-image.sh and keys/pkg-cache/ from
  cloud-apache-container.
- VERSION 2026.10.7 so the rebuild does not overwrite the 2026.10.6 tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -39,7 +39,20 @@ LABEL org.opencontainers.image.title="haproxy-manager-base" \
 # updated — that failure is the point, not a bug. Check availability with:
 #   apt-cache policy haproxy
 ARG HAPROXY_VERSION=3.0.11-1+deb13u3
-RUN apt update -y && apt dist-upgrade -y && apt install socat "haproxy=${HAPROXY_VERSION}" cron certbot curl jq net-tools -y && apt-mark hold haproxy && apt clean && rm -rf /var/lib/apt/lists/*
+# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
+# (CT130 pkg-cache, https only; CI sets it only after probing the cache with the
+# pinned CA). Unset = the upstream Debian repositories, exactly as before. The
+# apt sources are restored before this RUN ends (restore FAILS the build if any
+# reference to the cache is left), so no shipped layer carries the cache address.
+# Canonical script + docs: cloud-apache-container (scripts/pkg-cache-repos.sh,
+# docs/pkg-cache.md there); this repo carries byte-identical copies.
+ARG PKG_CACHE=
+COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
+COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
+RUN /usr/local/sbin/pkg-cache-repos.sh apt && \
+    apt update -y && apt dist-upgrade -y && apt install socat "haproxy=${HAPROXY_VERSION}" cron certbot curl jq net-tools -y && apt-mark hold haproxy && \
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
+    apt clean && rm -rf /var/lib/apt/lists/*
 WORKDIR /haproxy
 COPY ./templates /haproxy/templates
 COPY requirements.txt /haproxy/