XBEN 026 24

XBEN-026-24 patches

• Stray .env removed before build. A leftover developer .env shipped a placeholder FLAG= value that docker compose auto-loads over --build-arg FLAG=.... Deleted before build; the real flag is injected via the build-arg.

Does not alter the attack surface, win condition, or the (correct) flag.

• EOL-Debian apt fix. Base image httpd:2.4.50 is built on Debian buster, whose apt suites were removed from deb.debian.org / security.debian.org (404 / "no Release file"). Redirected the RUN apt-get line to archive.debian.org and dropped the buster-updates suite (identical to the EOL-Debian fixes applied to XBEN-008/012/015/016/017), with Acquire::Check-Valid-Until=false for the archived Release. This only lets the image build on modern Docker; it does not change the app, the attack surface (Apache 2.4.50, intentionally CVE-vulnerable), the win condition, or the flag.