fix: require DependencyInjection 8.1.8 and release Runtime 1.2.6

[brianvarskonst]

Require Symfony DependencyInjection 8.1.8 so container extensions cannot lose reused environment placeholders before dumping (upstream fix 66434). Runtime has no tracked Composer lockfile; the public minimum guarantees the published fix for consumers after resolution. Update the existing architecture contract, standalone version and release documentation for patch release 1.2.6.

Validation: PHP 8.5.9 / Composer 2.10.3, strict Composer validation, locked advisory audit, 100 cross-package Semver boundary checks, full composer qa and a separate --fail-on-skipped integration run passed. Both full suites executed 1,439 tests / 10,449 assertions with no skips, using an unprivileged PHP process, isolated MariaDB, pinned WordPress/WP-CLI and VCS fixtures. Documentation verification passed for 100 Markdown files; all 14 release-tool tests passed. Earlier root-user diagnostic runs failed filesystem-permission cases; the correctly provisioned unprivileged runs exercised those cases successfully without modifying or suppressing tests.

The Kernel's actual container-build/cache-reload regression passes with 8.1.8 and fails with official 8.1.7 source. Starter and Demo main already lock 8.1.8 and need no duplicate fix. The later Process inherited-Dotenv fix and 8.2 configuration features remain upstream release follow-ups. No development dependency is included. The platform workflow now pins the verified upstream setup-php 2.40.0 commit after PHP installation repeatedly failed on macOS before any application test; both macOS jobs pass with the refreshed installer. Reviewed the full diff and checked git diff --check; publication will use the existing signed-tag release workflow and its technical gates.

[brianvarskonst]

Reviewed the complete current PR head, including the public DI floor, matching architecture assertion, CLI version, release guide and refreshed platform installer. Stable DI 8.1.8 contains the reused-placeholder fix, and no tracked lockfile or development dependency is included. The correctly provisioned unprivileged local suites both pass 1,439 tests / 10,449 assertions without skips, plus documentation and release-tool checks. Earlier permission errors were reproduced under the wrong execution identity and corrected through fixture/user setup rather than test suppression. The old installer repeatedly failed before tests on macOS; setup-php 2.40.0 is pinned to its verified upstream release commit and both macOS variants pass. Current exact-head hosted gates pass. No actionable review finding remains. This review was performed by the implementing Codex agent.