[shellharbor]

Enforce branch-specific PHP minimums 8.2.35, 8.3.36, 8.4.27 and 8.5.12 for CVE-2026-109618/CVE-2026-109619. Reject PHP 8.1 and older, Moodle below 4.3, incompatible pairs and unverified branches. Moodle 4.3 is included; PHP 8.5 has no enabled Moodle pair yet. Remove obsolete templates and pin patched host/standalone bases by digest.

A shared policy guards build/startup and lifecycle operations. Activation/restore validate actual Moodle source against saved metadata and probe PHP before startup/import; cron preserves the image guard. The Python adapter refuses pre-policy deployment toolkits while retaining migration backup/diagnostic access. Fix PHP 8.2 stdin database-probe diagnostics using fixed, redacted stderr messages. Document existing-site migration, persistent AI rules and obsolete 1.2.0 artifacts. VERSION 1.2.1 is a candidate, not evidence of publication.

Validation on security source 531c341e9e15cdb0eead21fd1663b1aa7f5dbfc0:

• All 26 PR checks pass, including Python 3.8/3.12/3.14, configuration, security, packaging, documentation and real image tests.
• All six host E2E cases pass: Moodle 4.3/4.5/5.3 x PostgreSQL/MySQL, including native DB routing/state probes, HTTP, sessions, SMTP, cron, backup/restore and lifecycle checks. Final run.
• 144 Linux regressions pass (163 discovered, 19 opt-in checks handled separately).
• Seven local real Docker tests pass in 494.881 seconds: both standalone DB installations, HTTP/readiness/liveness, secrets/shutdown, runtime floors, initial Moodle 4.3 on actual PHP 8.2.35 and stdin diagnostics. App/web rebuilt with PHP 8.3.36; CI also builds/tests the matching pair. Image workflow.
• Python wheel/sdist and native archive built/verified; checksum, extraction, security assets and LF shell scripts checked. Independent security-review findings resolved.

Existing installations/data are not automatically migrated. No production deployment, live Kubernetes rollout or multi-architecture verification is claimed. Docker Hub/PyPI 1.2.1 publication has not been performed; the published 1.2.0 PHP runtime predates this policy.