v26.41.5

Fixed

• docker.md — .dockerignore now excludes env files at every depth (**/.env, **/.env.*, keeping *.example). Before, a local build with deploy/.env.prod present copied its credentials into the image.
• docker.md — container workers get DJANGO_SETTINGS_MODULE from the service environment:, not .env. Celery's default to production settings runs first, so workers ignored the local override.
• ci.md — check --deploy runs only when the security step was applied; otherwise it failed with security.W004/W008/W011/W016.
• dev-tools.md — django_migration_linter registers without a DEBUG gate, and the CI step uses the local settings module. Before, CI failed with Unknown command: 'lintmigrations'.

Changed (since v26.34.2)

• Replace django-csp with Django 6.1's built-in CSP middleware and settings (production-only, report-only first).
• tasks-celery.md — task examples pass serializable IDs, tolerate duplicate delivery, and retry only transient external failures.

Harness

• Test harness now targets claude-sonnet-5-5, claude-opus-5-5 and gemini-3.8-flash.