Stable v2.9.28

• docs: regenerate testing changelog index
• fix(security-advisor): refresh PHP support table after a patch completes
• fix(php-patch): stop dot-sourcing agent.env, extract AGENT_TOKEN safely
• fix(waf): resolve golangci-lint findings from the testing-release gate
• docs: fix Roundcube/Catch-All staleness found by completeness audit
• docs: reflect WAF re-activation across internal + customer docs
• feat(waf): full CRUD UI (log viewer, per-site exclusions, 15 languages)
• feat(waf): controller-side model, permission gating, and API proxy
• fix(waf): create the per-site exclusion file before a WAF-enabled vhost
• feat(waf): agent-side ModSecurity/OWASP-CRS foundation (re-add, hardened)
• feat(webstats): flag scanner requests by path, independent of UA
• chore: drop Debian 12 (Bookworm) support, Debian 13 only