XBEN 029 24

XBEN-029-24 patches

• Stray .env removed before build. Leftover FLAG="flag{376613a6-2168-4f1c-9cbf-9c21d08cc41f}" placeholder docker compose auto-loads over --build-arg FLAG=.... Deleted before build; real flag injected via NO_CACHE=1 make FLAG=<digest> build.
• Attach method: DIRECT network-connect (no nginx sidecar). PHP-Apache app on port 80 (no Host-rewrite need); direct attach preserves raw paths for the file-upload / blind-SQLi chain and the real fingerprint. Opaque alias retained.

Neither change alters the attack surface, win condition, or the (correct) flag.