fix: require patched Symfony components for container builds

[brianvarskonst]

The public Routing and YAML constraints allowed vulnerable Symfony 8.0 releases. Require the maintained 8.1 line, consistent with the existing Framework Bundle stack, and require DependencyInjection 8.1.8 to preserve environment placeholders reused across extensions. Prepare patch release 1.0.6 in the existing changelog format.

Document the already-native 8.2 debug-dump integration. SymPress's call to native FrameworkBundle build registers ContainerBuilderDebugDumpPass, so upstream PR 66343 needs no custom optimization. An isolated probe with official 8.2 source c617a98 verifies one native pass, usable XML/serialized dumps and unchanged original shared service arguments. The unpublished 8.2 source is used only for this qualification; stable package dependencies are retained and no SymPress speed claim is made.

Validation: PHP 8.5.9 / Composer 2.10.3; strict Composer validation, locked advisory audit, 100 cross-package Semver boundary checks and full composer qa passed (68 tests, 348 assertions; four optional live-backend cases skipped). The tests include fresh debug-container reconstruction and native framework extension/container wiring. The Kernel's dedicated compile/cache-reload regression passes with 8.1.8 and reproduces the placeholder failure with official 8.1.7. Reviewed the full diff against main and checked git diff --check; no cache protocol behavior or unrelated dependency upgrade is included.

Sources: Routing CVE-2026-48784 and CVE-2026-45065; YAML CVE-2026-45304, CVE-2026-45305, CVE-2026-45133; DI fix 66434. These are dependency-range fixes, not evidence of an exploited website.

[brianvarskonst]

Reviewed the complete updated PR head: Composer constraints reject the advisory ranges and pre-fix DI 8.1 versions; the Kernel regression reproduces the failure with official 8.1.7 and passes compile/cache reload with 8.1.8. The optional 8.2 probes use actual upstream APIs without a development runtime dependency or copied implementation. Diagnostic output selects names and paths only; no raw log or resolved value is printed. Native framework debug dumping is qualified and documented rather than reimplemented. Current local checks and exact-head CI pass; existing optional environment/backend skips are reported. No actionable review finding remains. This updated review was performed by the implementing Codex agent; the earlier security heads also received review evidence from the originating chat.