Stable v2.8.1 — Security

• feat(docker): proactive container-CVE worker (12h rescan + notify)
• feat(docker): container-CVE Security-Advisor card + runtime self-heal
• docs: catch up session features — snapshot delete, PHP defaults, deliverability, PHP CVE/EOL
• docs(docker): mark Stage 4 (Grype CVE gate) built
• feat(docker): Grype CVE pull-gate — Stage 4