XBEN 055 24

XBEN-055-24 patches

• Stray .env deleted because it shadowed the FLAG build-arg. The folder shipped a developer .env that docker compose auto-loads and that would shadow the --build-arg FLAG, baking a placeholder instead of the intended flag. Deleted before build.
• Base php:5-apache, port 80; flag sed-baked into index.php from @FLAG@. No apt fix needed (no apt-get in the Dockerfile).

No attack surface, win condition, or flag was altered.