Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Ops/CommandRunner.php

@@ -25,6 +25,66 @@ final class CommandRunner
         return !in_array('proc_open', $disabled, true);
     }
 
+    /**
+     * Was ein Kindprozess von der Umgebung sehen darf: Pfade, ein Zuhause fuer Composer und Git,
+     * aber kein APP_ENV, das einen Konsolenbefehl gegen die falsche Umgebung laufen liesse.
+     *
+     * @return array<string, string>
+     */
+    private function environment(): array
+    {
+        $environment = ['PATH' => getenv('PATH') ?: '', 'SystemRoot' => getenv('SystemRoot') ?: '', 'TEMP' => sys_get_temp_dir(), 'TMP' => sys_get_temp_dir()];
+        // Composer verlangt HOME (Linux) oder APPDATA (Windows) - ohne sie bricht `composer
+        // install` ab, waehrend `composer --version` noch laeuft. Git braucht HOME fuer .gitconfig.
+        foreach (['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'COMPOSER_HOME', 'PATHEXT', 'LANG', 'LC_ALL'] as $name) {
+            $value = getenv($name);
+            if (is_string($value) && '' !== $value) {
+                $environment[$name] = $value;
+            }
+        }
+        if (!isset($environment['HOME']) && !isset($environment['USERPROFILE'])) {
+            // Unter php-fpm ist HOME oft leer; ein Ordner in var/ tut es fuer Composer und Git.
+            $environment['HOME'] = sys_get_temp_dir();
+        }
+        if (!isset($environment['COMPOSER_HOME'])) {
+            $environment['COMPOSER_HOME'] = $environment['HOME'] ?? sys_get_temp_dir();
+        }
+
+        return $environment;
+    }
+
+    /**
+     * Die PHP-Kommandozeile, mit der Konsolenbefehle laufen.
+     *
+     * Aus einem Webprozess ist PHP_BINARY der Server selbst (php-fpm) oder leer (mod_php) - und
+     * `php-fpm bin/console` startet keinen Befehl. Dann wird die Kommandozeile im Pfad gesucht.
+     */
+    public function php(): string
+    {
+        if (isset($this->resolved['php'])) {
+            return $this->resolved['php'][0];
+        }
+        $candidates = [];
+        if ('cli' === \PHP_SAPI && '' !== \PHP_BINARY) {
+            $candidates[] = \PHP_BINARY;
+        }
+        $suffix = '\\' === \DIRECTORY_SEPARATOR ? '.exe' : '';
+        foreach ([\PHP_BINDIR.'/php'.$suffix, \PHP_BINDIR.'/php'.\PHP_MAJOR_VERSION.'.'.\PHP_MINOR_VERSION.$suffix, 'php'.$suffix, 'php'.\PHP_MAJOR_VERSION.'.'.\PHP_MINOR_VERSION.$suffix, \PHP_BINARY] as $candidate) {
+            if ('' !== $candidate && !\in_array($candidate, $candidates, true)) {
+                $candidates[] = $candidate;
+            }
+        }
+        foreach ($candidates as $candidate) {
+            if ($this->run([$candidate, '-r', 'echo PHP_VERSION;'], sys_get_temp_dir(), 30)['ok']) {
+                $this->resolved['php'] = [$candidate];
+
+                return $candidate;
+            }
+        }
+
+        return $candidates[0] ?? 'php';
+    }
+
     /**
      * @param list<string> $command
      *
@@ -43,7 +103,7 @@ final class CommandRunner
             $cwd,
             // A minimal, predictable environment: no inherited APP_ENV that would make a console
             // command run against the wrong environment.
-            ['PATH' => getenv('PATH') ?: '', 'SystemRoot' => getenv('SystemRoot') ?: '', 'TEMP' => sys_get_temp_dir()],
+            $this->environment(),
         );
         if (!is_resource($process)) {
             return ['ok' => false, 'exit' => -1, 'output' => sprintf('%s konnte nicht gestartet werden.', $command[0])];
@@ -109,7 +169,7 @@ final class CommandRunner
         }
         // A phar in the project is the way on hosting where nothing is installed globally.
         if (is_file($cwd.'/'.$executable.'.phar')) {
-            $candidates[] = [PHP_BINARY, $cwd.'/'.$executable.'.phar'];
+            $candidates[] = [$this->php(), $cwd.'/'.$executable.'.phar'];
         }
         foreach ($candidates as $candidate) {
             if ($this->run([...$candidate, '--version'], $cwd, 30)['ok']) {