fix: require safe Symfony components and preserve reused environment values

[brianvarskonst]

The public Routing and YAML constraints allowed vulnerable Symfony 8.0 releases. Require the maintained 8.1 line, consistent with the existing Kernel stack, and require DependencyInjection 8.1.8 so reused environment placeholders survive extension processing and container dumping. Prepare patch release 1.1.8 and align the public installation documentation.

The new regression compiles an actual Kernel container with two extensions sharing an environment value that the first extension overrides, then reloads the cached container. It fails against the official DependencyInjection 8.1.7 source with a literal internal placeholder and passes with 8.1.8.

Document the native 8.2 compile-time environment log and include a synthetic availability probe. With the official 8.2 source c617a98 it resolves the marked node and prints only bool:SYMPRESS_TEST_FEATURE and fixture.enabled; with stable 8.1 it exits 2 with an unavailable-API message. The guide distinguishes the Kernel command from Framework's native descriptors and explains inspection of an explicit fresh build without printing raw logs or values. Kernel currently does not opt its own configuration into the new API; stable 8.2 publication remains the feature blocker.

Validation: PHP 8.5.9 / Composer 2.10.3; strict Composer validation, locked advisory audit, 100 cross-package Semver boundary checks and full composer qa passed (79 tests, 375 assertions; the existing seven PHPUnit notices and one environment skip remain). QA ran as an ordinary user in an isolated container so read-only filesystem behavior was exercised. The full diff was reviewed and git diff --check passed. No tracked lockfile or unrelated dependency upgrade is included.

Sources: Routing CVE-2026-48784, Routing CVE-2026-45065, YAML CVE-2026-45304, CVE-2026-45305, CVE-2026-45133, and DI fix 66434. Allowed-range findings do not establish a vulnerable installed website.

[brianvarskonst]

Reviewed the complete updated PR head: Composer constraints reject the advisory ranges and pre-fix DI 8.1 versions; the Kernel regression reproduces the failure with official 8.1.7 and passes compile/cache reload with 8.1.8. The optional 8.2 probes use actual upstream APIs without a development runtime dependency or copied implementation. Diagnostic output selects names and paths only; no raw log or resolved value is printed. Native framework debug dumping is qualified and documented rather than reimplemented. Current local checks and exact-head CI pass; existing optional environment/backend skips are reported. No actionable review finding remains. This updated review was performed by the implementing Codex agent; the earlier security heads also received review evidence from the originating chat.