Patch five locked Symfony packages after the November 4 security advisories #1028

The preserved #1025 protected-queue run now fails the repository-owned composer audit --locked step: run 41902142241, Repository contracts job 126827101214, exit 1 at 2026-11-04 19:59 UTC. Exact queue source is 85dca54120e5e3c1acac9b44aca823ec5889319b with reviewed tree 22a3577fdfe3a8bd37355e10f527f65f9b2701a3; it is unaccepted and must not be rerun or waived to hide this result.

The complete audit reports eight advisories in five root composer.lock packages:

These match the public November 4 Symfony batch also tracked in Workflow #970 and Waterline #279/#280. Primary examples: Filesystem advisory, Yaml advisory. The current minor's fixed patch is 7.4.23. Open Server searches found only broader #802 (published-image scanning), #855 (PHP unit baseline) and #325; none tracks this narrow active-root-lock repair.

General explicitly assigns a separate P1 security-source exception before resuming #1025. Prepare a draft PR from actual main dff06e5d8d0416df8cfcec811fefcda7bb93d54e, update only these five affected Symfony package records to the fixed same-minor patch, preserve every unrelated pin/manifest/top-level record, and run complete fresh before/after audits, strict validation, source contracts and independent Security review. No scripts/plugins/install are needed for the metadata update; no audit ignore, platform-requirement bypass or waiver is permitted.

Keep the failed queue evidence unchanged and dependency changes outside #1025. After the dependency source PR is independently accepted on main, #1025 needs a normal main refresh and fresh exact-pair qualification/carry. #1026 stays frozen. No more PHP Server releases, frozen 3.1 tag/image/artifact/runtime/recovery/release stops, and downstream/Cloud gates remain fully held; this source task rebuilds or publishes nothing.