ci: adopt estate reusable CI caller v2.5.0

- ci.yml replaced with thin caller (tests: stubs, has_js: true)
- security-audit.yml extracted as standalone workflow
- deploy.yml: contents write permission for phpcbf token scope
- composer.json: pin scripts to vendor/bin/ paths
- phpunit.xml.dist: PHPUnit 9.6 XSD ref; drop deprecated convert* attrs
- CHANGELOG.md: created; version bump 2.4.1 to 2.5.0

Agent-Session: claude/adopt-ci-20260616

phpunit.xml.dist

@@ -1,11 +1,10 @@
 <?xml version="1.0"?>
 <phpunit
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/9.6/phpunit.xsd"
     bootstrap="tests/bootstrap.php"
     backupGlobals="false"
     colors="true"
-    convertErrorsToExceptions="true"
-    convertNoticesToExceptions="true"
-    convertWarningsToExceptions="true"
 >
     <testsuites>
         <testsuite name="unit">