ci: adopt estate reusable CI caller v2.5.0

- ci.yml replaced with thin caller (tests: stubs, has_js: true)
- security-audit.yml extracted as standalone workflow
- deploy.yml: contents write permission for phpcbf token scope
- composer.json: pin scripts to vendor/bin/ paths
- phpunit.xml.dist: PHPUnit 9.6 XSD ref; drop deprecated convert* attrs
- CHANGELOG.md: created; version bump 2.4.1 to 2.5.0

Agent-Session: claude/adopt-ci-20260616

.github/workflows/deploy.yml

@@ -4,8 +4,12 @@ on:
   push:
     branches: [ main ]
 
+# contents: write required so the ci.yml caller can pass write permission
+# through to the phpcbf auto-commit step in the reusable workflow.
+# (phpcbf commit only fires on pull_request events, but GH enforces caller
+# permissions at token-grant time, not at step-execution time.)
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: deploy-peptide-news-plugin