fix: address Copilot review comments on klick-deploy package import

[Copilot]

Merges the automated sync from perspikapps/flekskit (PR #2) and resolves all 16 Copilot review findings — covering shell injection vectors, silent failure paths, incorrect docblocks/descriptions, and a broken CI output key.

Security / correctness

• set_env.php: Validate secret keys against ^[A-Z0-9_]+$ before interpolating into shell commands/sed patterns
• cpanel.php: escapeshellarg() applied to module name, function name, and every key=value argument in uapi()
• set_version.php: Replace bare echo $version$build with printf %s + escapeshellarg to prevent metacharacter injection
• upload_assets.php: Use the configured $git binary (not hardcoded git) in runLocally; escapeshellarg($path) for directory check; trim() SHAs before strict !== comparison; fix directory-existence check to use && echo 1 || echo 0 pattern instead of unreliable exit-code comparison

Bug fixes

• cpanel_mail.php: Remove trailing space from 'passwd_pop ' UAPI function name; throw on non-1 update status instead of silently continuing
• cpanel_domain.php: Fix array_search() result mixed into boolean expression — searchDomain(...) !== false with explicit $rootExists bool
• platform_savepub.php: Replace non-existent warn() with Deployer's warning()
• src/main.php: Wrap keep_releases in a closure so isUnstable() is evaluated per-host at task time, not at recipe load time
• actions/run-deployer/action.yml: Fix mismatched output key php-packages=false → packages=false so steps.check.outputs.packages is populated in both branches
• composer.json: Remove Laravel-specific lifecycle scripts (post-autoload-dump / post-create-project-cmd / post-root-package-install / post-update-cmd) that reference artisan and Illuminate\Foundation — absent in this library

Docs / metadata

• readme.md: Replace removed strategy_*.php import paths with src/main.php
• CHANGELOG.md: Remove platform:crontab:remove entry — task is not implemented
• platform_knownhosts.php: Correct copy-pasted docblock (described env vars; actually manages SSH known_hosts)
• platform_listhosts.php: Same — fix docblock to describe host listing
• platform_encrypt.php: Fix desc('List selected hosts') → desc('Encrypt a value for the current host')