chore: release 0.27.0

[s2x]

What

Cut the 0.27.0 release: promote the [Unreleased] section of
CHANGELOG.md to a dated release entry and restore a fresh
[Unreleased] section.

Also adds the missing changelog entry for #681 (merge of the duplicate
allowlist bullet in docs/security.md), which was merged on master in
the 0.27.0 window but had no changelog entry (completeness check stage).

What's in 0.27.0

The promoted section carries 28 entries across five categories — Docs,
Added, Fixed, Performance and Tests. Highlights, each with its issue
link:

• Added: deprecation-removal plan for 1.0 ([Docs] Deprecations have no removal plan — serve_files has been deprecated for 15 minor releases #595); parallel Docker
  test runs across git worktrees ([Enhancement] Run the Dockerized test suite in parallel across git worktrees without port conflicts #676); opt-out for the config-cache
  permission guard ([Enhancement] Add an explicit opt-out for the config-cache ownership guard #648); cookie-count capping deviation ([Nit] Cookie parsing ignores PHP's max_input_vars — FPM silently drops past the limit, bundle parses all #628);
  cause-specific ServerNotRunningException ([Enhancement] ServerNotRunningException message is indistinguishable for "not running" vs "running but unverifiable" #657); docs-only CI
  skip-propagation ([CI] Skip full lint/test matrix for docs-only and workflow-doc changes #619); Connection: close on streamed HTTP/1.1
  responses ([Nit] Streamed responses don't echo Connection: close to HTTP/1.1 clients that ask for it #621).

• Performance: ResponseConverter header-name normalisation cache
  bound ([Memory leak] ResponseConverter header-name normalisation cache is an unbounded process-lifetime static #574) and related optimisations ([Performance] StaticFilesMiddleware realpath cache uses O(n) array_shift eviction and thrashes on high-cardinality URLs #558, [Performance] PollingMonitorWatcher restarts tree traversal from the root on every tick #559, [Performance] RequestConverter control-character filter runs preg_match per header per request — consider strpbrk/strcspn #630).

• Tests/CI/tooling: runner scope and scheduler fixes ([Tests] 43 fixed-duration usleep() waits plus "sleep 1" in composer test — Util\Wait::until() already exists #592, [Tests] ConfigLoaderTest::setUp() creates temp dirs with 0777 subject to umask — directory-permission guard makes fixtures environment-dependent #613,
  [Code Quality] ConfigLoader E_USER_WARNING fallback escalates to a hard exception under a throwing error handler — untested and undocumented #615, SchedulerWorkerTest: willReturn(DateTimeImmutable('+1 second')) evaluates once and shared 'test_service' key causes static $tickCallbacks cross-test deduplication #668), lint metadata items ([CI] No structural validation for CHANGELOG.md — duplicate headings, stale entries, and format violations pass CI silently #654, [Enhancement] Provide a Dockerfile for running the test suite without local PHP/extensions #674, [Enhancement] Run the Dockerized test suite in parallel across git worktrees without port conflicts #676), config(/timeout)
  flexibility ([Enhancement] Allow disabling connection_timeout/keepalive_timeout from YAML — config min(1) contradicts ServerWorker's 0=disabled semantics #625, [Enhancement] Add an explicit opt-out for the config-cache ownership guard #648, [Nit] Streamed responses don't echo Connection: close to HTTP/1.1 clients that ask for it #621, [Enhancement] ServerNotRunningException message is indistinguishable for "not running" vs "running but unverifiable" #657).

• Docs: UPGRADE.md backfill for 0.18–0.24 ([Docs] UPGRADE.md has no sections for 0.18–0.24 despite BC-relevant changes #656), deprecation plan
  ([Docs] Deprecations have no removal plan — serve_files has been deprecated for 15 minor releases #595), docs/workflow cleanups ([Docs] security.md: "Use the allowlist" bullet is a verbatim subset of "Prefer the allowlist over the denylist" — merge into one #681, [CI] Workflow runs on pull_request only — master is never verified and composer audit never re-runs #597, [Docs] 0.25.0 release notes: undocumented BC break in ResponseConverterStrategyInterface, duplicate Fixed heading, stale #571 entry #641, [Performance] ResponseConverter::extractHeaders() re-lowercases every header name that HeaderNameNormalizer already lowercased internally #726).

Checklist

• Changelog entry dated ([0.27.0] - 2026-08-23)
• Fresh [Unreleased] restored on top
• Every milestone issue referenced (completeness check ran clean —
  [CI] Include bin/ scripts in php-cs-fixer, PHPStan, and Rector coverage #635 lives in the 0.26.0 section as that change landed before 0.26 was
  cut; bin/pow.php --round is hard-coupled to the pi harness's .pi-subagents/ layout, undocumented as a prerequisite #692 closed as NOT_PLANNED, a process meta-issue, so it is
  correctly outside the product changelog)
• Release branch v0.27.0 + tag v0.27.0 after merge
• Close milestone 0.27.0 after release