docs: record Symfony 8.1 upgrade results, update stack references

- Plan doc: mark Phases 0-3 + worker-mode state audit complete with
  verified results; resolve open questions (all src/ services are final
  readonly - no ResetInterface needed under kernel-reusing runner)
- CHANGELOG: Unreleased entries for the 8.1 bump and the
  runtime/frankenphp-symfony removal (incl. FRANKENPHP_LOOP_MAX note)
- ROADMAP: current stack now Symfony 8.1; webauthn research note updated
- bin/dev.sh: correct stale PHP requirement comment

docs/symfony-8.1-upgrade-plan.md

@@ -198,13 +198,15 @@ twig-bundle, uid, yaml) and tick each item against this codebase.
 Rollback = `git revert` the bump commit + redeploy previous image tag.
 No data/schema migrations are involved (no database).
 
-## 8. Open questions
+## 8. Open questions — resolved during implementation
 
-- [ ] Confirm none of our listeners/services relied on implicit behavior
-      of `Runtime\FrankenPhpSymfony\Runner` (e.g. per-request kernel
-      reboot). The built-in runner reuses the kernel — our services must
-      implement `ResetInterface` where they hold per-request state
-      (`ConfigBag`, nonces, cache-touching services). Audit in Phase 0.
-- [ ] Decide whether to pin `symfony/*` as `8.1.*` or `^8.1` going
-      forward (current convention is minor-pinned — keep `8.1.*`).
-- [ ] Regenerate `config/reference.php` — scripted or manual dump?
+- [x] ~~Confirm none of our listeners/services relied on implicit behavior
+      of `Runtime\FrankenPhpSymfony\Runner`.~~ **Resolved:** audited every
+      class in `src/` — all are `final readonly` with constructor-injected
+      dependencies and no mutable state. No `ResetInterface` needed; kernel
+      reuse across worker requests is safe.
+- [x] ~~Decide whether to pin `symfony/*` as `8.1.*` or `^8.1`.~~
+      **Resolved:** kept minor-pinned `8.1.*`, matching repo convention.
+- [x] ~~Regenerate `config/reference.php` — scripted or manual dump?~~
+      **Resolved:** it's gitignored and auto-regenerated by Flex on
+      `composer update`; already refreshed for 8.1 during the bump.