ci: adopt estate reusable CI caller v2.5.0

- ci.yml replaced with thin caller (tests: stubs, has_js: true)
- security-audit.yml extracted as standalone workflow
- deploy.yml: contents write permission for phpcbf token scope
- composer.json: pin scripts to vendor/bin/ paths
- phpunit.xml.dist: PHPUnit 9.6 XSD ref; drop deprecated convert* attrs
- CHANGELOG.md: created; version bump 2.4.1 to 2.5.0

Agent-Session: claude/adopt-ci-20260616

composer.json

@@ -21,9 +21,9 @@
         }
     },
     "scripts": {
-        "test": "phpunit",
-        "lint": "phpcs",
-        "lint:fix": "phpcbf",
+        "test": "vendor/bin/phpunit --configuration phpunit.xml.dist",
+        "lint": "vendor/bin/phpcs",
+        "lint:fix": "vendor/bin/phpcbf",
         "check": [
             "@lint",
             "@test"