[monikaspectra]

Summary

• rebuild the floating PHP 8.4 base with a hard PHP 8.4.27 security floor for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
• release EPCC 2.02 Argonaut and repair exported save metadata so canonical compatibility data no longer falls back to NIGHTLY / 0.91
• refresh Composer and npm lockfiles within their existing constraints
• add fresh-base container smoke testing and harden stable multi-architecture publishing, verification, tagging, and GitHub Release creation
• update README, changelog, test documentation, and agent guidance to match the current configuration and release process

Validation

• php artisan test — 18 tests, 65 assertions
• composer audit --locked — no advisories
• npm audit --package-lock-only --omit=dev — no production advisories
• full npm audit retains 32 build/dev-only advisories; no forced/breaking update was applied
• docker build --pull ... — passed on PHP 8.4.27 using npm ci
• runtime homepage, health check, /api/version, and canonical save metadata smoke checks — passed
• actionlint — passed
• two independent follow-up reviews — no blockers

Release behavior

After merge, dispatch Release Image from main with:

• version name: Argonaut
• version number: 2.02

The workflow verifies native amd64 and arm64 candidates before promoting v2.02 and latest, then creates the matching v2.02 Git tag and GitHub Release.