[jsnmrs]

Summary

• Update CodeIgniter from 4.7.5 to 4.7.6, a security release. It fixes file cache deleteMatching() path traversal, Model::replace() mass assignment, sanitize_filename() path traversal, and named bind substitution inside quoted SQL. None of the breaking changes apply here: the only replace() call is a Query Builder replace in FeedIngestionService, and the raw queries use no binds. No skeleton files changed in this release, so tatter/patches was not needed.
• Add ddev framework-update [--check] [version], a host command that scripts the README's manual update workflow: resolve the installed and latest versions, print the changelog and upgrade note links, list skeleton file changes from the GitHub compare API, run tatter/patches on the host only when skeleton files changed, then run ddev composer update codeigniter4/framework, ddev test, and ddev check. It stops before committing. --check is a read-only dry run.
• Point the README's "Updating CodeIgniter" section at the command.
• Also carries the earlier .ddev/config.yaml commit that moves the web container to Node 24.

Testing

• The 4.7.6 bump itself was performed by running the new command end to end: lint clean, 648 tests passing with the usual 27 environment skips, shellcheck and CLI route checks OK, all URLs returning 200.
• Negative paths checked by hand: dirty tree and unknown option refuse with a one-line reason, --check on a clean branch exits 0 after reporting the skeleton delta, and passing the current version exits 0 with "already on".
• The patcher conflict path was not exercised, since this release has no skeleton delta.