docs: document deprecation removal plan for 1.0 (closes #595)

[s2x]

Description

Closes #595

The bundle carried three deprecations with no usable removal version stated ('the next major release' is ambiguous at 0.x per SemVer). This change records a concrete removal target — 1.0 — for all three and makes the deprecation messages self-sufficient.

Changes

• src/DependencyInjection/ConfigurationTreeBuilder.php: the serve_files / root_dir / static_files setDeprecated messages now state removal in 1.0 and point at docs/security.md#static-files-protection (allowing the extension allowlist caveat).
• src/Utils.php: @deprecated and trigger_deprecation message for Utils::reboot() state removal in 1.0.
• src/Http/Request.php: @deprecated docblock and runtime trigger_error message for Request::withHeader() state removal in 1.0.
• UPGRADE.md: new ## Deprecations table (since / replacement / removed-in 1.0) for all three.
• CONTRIBUTING.md: new ## Deprecation Policy — concrete removal version mandatory; a deprecation older than six minors must be removed or re-justified.
• CHANGELOG.md: entry under [Unreleased].
• New test testConfiguredTreeDeprecatesLegacyStaticFileNodes (config-node deprecations fire with 'Will be removed in 1.0'); testWithHeaderTriggersDeprecation now also asserts the removal version.
• Utils::reboot() deprecation test deferred to [Chore] composer.json ships an unused dependency and omits three that are imported directly #588 (bundle does not declare symfony/deprecation-contracts).

Changelog

Documented the deprecation-removal plan for 1.0 (serve_files/static_files, Utils::reboot(), Request::withHeader()); new Deprecations table in UPGRADE.md and a deprecation policy in CONTRIBUTING.md.

Proof of Work

docs/proof_of_work/0595-deprecations-have-no-removal-plan/ — 2 review round(s)

Code Review

• Passed subagent code review
• Every finding answered