Fix: use dl-cdn.alpinelinux.org everywhere for consistent package resolution

Both build-nvidia-module.sh (apk add) and mkimage.sh (--repository) now
explicitly use dl-cdn. Local builder mirror config is ignored.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bible-local/architecture/runtime-flows.md

@@ -73,10 +73,11 @@ build.sh [--authorized-keys /path/to/keys]
   When Alpine releases a new linux-lts patch (e.g. r0 → r1), update KERNEL_PKG_VERSION
   in VERSIONS — that's the only place to change. The build will fail loudly if the pin
   doesn't match the installed headers, so stale pins are caught immediately.
-- **All three must use the same APK mirror.** `build-nvidia-module.sh` and `mkimage.sh`
-  both read `/etc/apk/repositories` from the builder. Never hardcode `dl-cdn.alpinelinux.org`
-  in `build.sh` — it may serve a different package state than the builder's configured mirror,
-  causing "unable to select package" failures even when the pin is correct.
+- **All three must use the same APK mirror: `dl-cdn.alpinelinux.org`.** Both
+  `build-nvidia-module.sh` (apk add) and `mkimage.sh` (--repository) explicitly use
+  `https://dl-cdn.alpinelinux.org/alpine/v${ALPINE_VERSION}/main|community`.
+  Never use the builder's local `/etc/apk/repositories` — its mirror may serve
+  a different package state, causing "unable to select package" failures.
 - `linux-lts-dev` is always installed (not conditional) — stale 6.6.x headers on the
   builder would cause modules to be built for the wrong kernel and never load at runtime.
 - NVIDIA modules go to `overlay/usr/local/lib/nvidia/` — NOT `lib/modules/<kver>/extra/`.