- ci.yml replaced with thin caller (tests: stubs, has_js: true) - security-audit.yml extracted as standalone workflow - deploy.yml: contents write permission for phpcbf token scope - composer.json: pin scripts to vendor/bin/ paths - phpunit.xml.dist: PHPUnit 9.6 XSD ref; drop deprecated convert* attrs - CHANGELOG.md: created; version bump 2.4.1 to 2.5.0 Agent-Session: claude/adopt-ci-20260616