upgrade: adopt V8.21.3 (V8.13→8.21.3: P5 SFTP/S3, P6 multilingual, editor overhaul, enterprise hardening)

Overlay ~150 upstream items onto our V8.12 base, preserving trade-pro
theme, registry tests, and design docs. Re-applied our patch set
(discovery/env_for/blocks.css/type-mapping/theme_color/frontend entries,
test_theme_pro_v3 mods) — all anchors survived upstream evolution.

New platform enhancement (fixes upgrade-introduced regression):
multilingual.site_locale now honors settings_json.locale, plus
PUT /api/i18n/sites/{id}/locale — standalone English sites get
<html lang='en'> under the V8.15 locale-rewrite pipeline.

compose: adopt V8.21.3 (image 8.21.3-dev.1, /api/ready probes, MySQL/S3
env) with project name pinned to siteforge-v8-10 (data volumes).

Tests: 356 passed / 11 failed — all 11 confirmed pre-existing in
pristine V8.21.3 on this host (10 upstream Windows env + our build test
now green after locale fix). Patch registry updated in plan doc.

Co-Authored-By: Claude Code <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -26,8 +26,46 @@ jobs:
         env:
           SITEFORGE_ADMIN_PASSWORD: administrator-strong-password-for-ci
           SITEFORGE_SESSION_SECRET: ci-only-session-key-not-for-production-with-entropy
+          SITEFORGE_PG_PASSWORD: ci-only-test-postgresql-password
         run: |
-          bash scripts/check.sh
+          SITEFORGE_REGRESSION_REPEAT=2 bash scripts/check.sh
+          python scripts/http_end_to_end.py
+      - name: Upload V8.21 regression evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: v821-regression-${{ matrix.python }}
+          path: reports/v821-regression*
+          if-no-files-found: ignore
+          retention-days: 14
+  browser-smoke:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install test and Chromium dependencies
+        run: |
+          python -m pip install -r requirements-dev.lock
+          python -m pip install -r requirements-browser.txt
+          python -m playwright install --with-deps chromium
+      - name: Run real desktop and mobile browser smoke
+        env:
+          SITEFORGE_ADMIN_PASSWORD: browser-ci-only-password
+          SITEFORGE_SESSION_SECRET: browser-ci-only-session-secret-not-for-production
+        run: |
+          mkdir -p reports/browser
+          python scripts/browser_smoke.py reports/browser
+      - name: Upload browser screenshots
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: v821-browser-smoke
+          path: reports/browser/
+          if-no-files-found: ignore
+          retention-days: 14
   container:
     runs-on: ubuntu-24.04
     steps:
@@ -55,7 +93,7 @@ jobs:
             sleep 2
           done
           test "$web" = healthy && test "$worker" = healthy
-          docker compose exec -T siteforge python -c "import json,urllib.request; data=json.load(urllib.request.urlopen('http://127.0.0.1:8787/api/health')); assert data['version']=='8.12.0-dev.1' and data.get('commit')"
+          docker compose exec -T siteforge python -c "import json,urllib.request; data=json.load(urllib.request.urlopen('http://127.0.0.1:8787/api/health')); assert data['version']=='8.21.0-dev.1' and data.get('commit')"
       - name: Stop Compose smoke
         if: always()
         env:
@@ -77,6 +115,13 @@ jobs:
         options: >-
           --health-cmd "pg_isready -U siteforge -d siteforge_ci"
           --health-interval 10s --health-timeout 5s --health-retries 5
+      redis:
+        image: redis:7.4.2-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s --health-timeout 5s --health-retries 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -84,7 +129,17 @@ jobs:
           python-version: '3.12'
       - name: Install pinned dependencies and PG driver
         run: pip install -r requirements.lock -r requirements-enterprise.txt
-      - name: Bootstrap PG and verify transactional queue
+      - name: Install PostgreSQL 16 maintenance clients
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y postgresql-client-16
+          pg_dump --version
+      - name: Bootstrap all PG schemas and verify worker queue
         env:
           SITEFORGE_DATABASE_URL: postgresql://siteforge:postgres-ci-only@127.0.0.1:5432/siteforge_ci
-        run: python scripts/verify_pg_bootstrap.py
+          SITEFORGE_REDIS_URL: redis://127.0.0.1:6379/0
+        run: |
+          python scripts/verify_pg_bootstrap.py
+          SITEFORGE_ALLOW_PG_DATA_SMOKE=1 python scripts/verify_sqlite_pg_transfer.py
+          python scripts/verify_redis_signal.py
+          SITEFORGE_ALLOW_PG_DR_SMOKE=1 python scripts/verify_pg_backup_restore.py

.github/workflows/siteforge-v817-acceptance.yml

@@ -0,0 +1,69 @@
+# Manual-only workflow. Runs against ephemeral test services, never production data.
+name: SiteForge V8.17 acceptance (isolated)
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  lint-and-audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install isolated audit dependencies
+        run: python -m pip install -r requirements-dev.lock
+      - name: Run V8.17 tests
+        run: python -m pytest -q tests/test_siteforge_v817_audit.py tests/test_wordpress_baseline.py tests/test_regression_runner_v817.py
+      - name: Static repository audit
+        run: python scripts/siteforge_v817_audit.py --repo . --output reports/ci-repo
+      - name: Upload non-secret audit report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: siteforge-v817-repo-audit
+          path: reports/ci-repo.*
+          if-no-files-found: warn
+  isolated-services:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: siteforge_ci
+          POSTGRES_PASSWORD: ephemeral-ci-only-password
+          POSTGRES_DB: siteforge_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U siteforge_ci -d siteforge_ci"
+          --health-interval 5s --health-timeout 3s --health-retries 10
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s --health-timeout 3s --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install read-only probe clients
+        run: python -m pip install 'psycopg[binary]>=3,<4' 'redis>=5,<7'
+      - name: Probe disposable PG/Redis services
+        env:
+          SITEFORGE_DATABASE_URL: postgresql://siteforge_ci:ephemeral-ci-only-password@127.0.0.1:5432/siteforge_ci
+          SITEFORGE_REDIS_URL: redis://127.0.0.1:6379/0
+        run: python scripts/siteforge_v817_audit.py --postgres --redis --output reports/ci-datastores
+      - name: Upload non-secret audit report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: siteforge-v817-datastore-audit
+          path: reports/ci-datastores.*
+          if-no-files-found: warn