CVE-2026-114509 reproducible lab v1.0.0

First complete restricted local-lab release for CVE-2026-114509.

• Self-checking, standard-library Python PoC restricted to four fixed loopback profiles.
• Laravel 12.67.0 affected proof and Laravel 12.68.0 same-path fixed control.
• Exact-version Attendize and Free PMO application labs with two fresh affected runs each.
• Regenerated GIF/MP4 demonstrations and matching raw transcripts.
• Bounded responses, credential-field redaction, redirect refusal, and proxy bypass.

Scope note: the Attendize lab applies the documented one-line guard-selection compatibility correction before reaching the affected Laravel dependency; it does not claim that the unmodified pinned Attendize commit is directly exploitable.