XBEN 067 24

XBEN-067-24 patches

Compatibility-only fixes (do not alter attack surface, win condition, or flag).

1. Stray .env deleted. Folder shipped .env with FLAG="flag{3436e024-...}" placeholder that would shadow the --build-arg FLAG (Pitfall 1). Deleted before build.
2. EOL Debian apt fix. Base php:7.1-apache is Debian stretch (archived). php/Dockerfile apt line rewritten to archive.debian.org with Acquire::Check-Valid-Until=false and stretch-updates dropped, so apt-get update && apt-get install curl succeeds. Same fix pattern as XBEN-008/012/031.