Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Ops/Updater.php

@@ -29,7 +29,7 @@ final class Updater
         private string $databaseUrl,
         private CommandRunner $runner,
         private Connection $db,
-        private string $php = PHP_BINARY,
+        private ?string $php = null,
     ) {
     }
 
@@ -288,7 +288,12 @@ final class Updater
             if (!$step($steps, 'Rauchtest', $health['ok'], $this->lastLine($health['output']))) {
                 throw new \RuntimeException('health');
             }
-        } catch (\RuntimeException) {
+        } catch (\Throwable $error) {
+            // Nicht nur die eigenen Abbrueche: jeder Fehler auf dem Weg nimmt den Rueckweg, statt
+            // den Wartungszustand ohne ein Wort stehen zu lassen.
+            if (!$error instanceof \RuntimeException) {
+                $step($steps, 'Unerwarteter Fehler', false, $error->getMessage());
+            }
             $this->rollback($steps, $from, $migrated ? $backup : null, $step);
             $this->write($steps, $target, false);
 
@@ -438,7 +443,7 @@ final class Updater
     /** @return array{ok: bool, exit: int, output: string} */
     private function console(array $arguments, int $timeout): array
     {
-        return $this->runner->run([$this->php, ...$arguments], $this->root, $timeout);
+        return $this->runner->run([$this->php ??= $this->runner->php(), ...$arguments], $this->root, $timeout);
     }
 
     /** The SQLite file behind DATABASE_URL, or null for a server database. */