fix(ci): resolve the CentOS repositories from one upstream

Reverses the reasoning of 7a836f934c. That commit read the metalink as the
outlier because two mirrors agreed with each other, and dropped its digest
check. The metalink was right: it advertises 0ebc31a075dcba98... for x86_64
BaseOS, which is byte-identical to the sha512 of the repomd.xml that
mirror.stream.centos.org serves today. The two mirrors that agreed were both
stale, and the check that was removed is the one that had been refusing them.

Without it baseos and appstream resolve independently, so they can land on
mirrors at different sync generations. A stale appstream then offered
python3-devel-3.12.12-3.el10 while a current baseos carried python3 at -5 and
-6; the canonical repositories list identical release sets and no -3.el10 at
all. sys-pip could not satisfy the dependency, on x86_64 at 01:35 and on
aarch64 at 13:29 of the same run, each after a full dnf upgrade had already
run.

The three repositories the image enables are pinned to the canonical upstream
so the set always shares one sync. baseos and appstream take the
<repo>/<arch>/os layout; extras-common is a SIG repository and needs its own
shape. Every other repository keeps the metalink upstream ships, which is why
the digest check returns for them.

Verified against the repository files the image ships: both spellings of the
stream segment rewrite, the disabled repositories stay untouched, and all
three pinned paths answer 200 for x86_64 and aarch64.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/install/dnf-mirrors.sh

@@ -1,10 +1,4 @@
 #!/usr/bin/env bash
-# CentOS' metalink carries its own sha512 for repomd.xml, so the digest and
-# the bytes arrive from two sources that can disagree; when they do, every
-# mirror fails the checksum and no retry clears it. The mirrorlist serves the
-# same mirrors with no second digest to contradict them, giving up the
-# metalink's integrity check on repomd.xml while packages stay GPG-verified.
-# Fedora ships the same metalink shape unaffected, so it is left alone.
 set -euo pipefail
 
 shopt -s nullglob
@@ -13,4 +7,19 @@ if [[ ${#repos[@]} -eq 0 ]]; then
 	exit 0
 fi
 
-sed -i -E 's#^metalink=(https?://mirrors\.centos\.org)/metalink\?#mirrorlist=\1/mirrorlist?#' "${repos[@]}"
+upstream='https://mirror.stream.centos.org'
+
+for_repo() {
+	# Param: $1 repo id as the metalink query spells it, $2 directory on the upstream
+	sed -i -E \
+		"s#^metalink=https?://mirrors\\.centos\\.org/metalink\\?repo=centos-$1-([^-&]+)-stream.*#baseurl=$upstream/\\1-stream/$2/\\\$basearch/os/#" \
+		"${repos[@]}"
+}
+
+for_repo baseos BaseOS
+for_repo appstream AppStream
+
+# Exception: a SIG repository is laid out as SIGs/<stream>/<sig>/<arch>/<component>, which for_repo's <repo>/<arch>/os shape cannot express.
+sed -i -E \
+	"s#^metalink=https?://mirrors\\.centos\\.org/metalink\\?repo=centos-extras-sig-extras-common-([^-&]+)-stream.*#baseurl=$upstream/SIGs/\\1-stream/extras/\\\$basearch/extras-common/#" \
+	"${repos[@]}"