chore: drop Magento 2.4.6 from the image matrix

[brtkwr]

Stacked on #38. Fixes the red main build from #37's merge.

Why 2.4.6 has to go

It is not buildable any more, on any architecture. Magento 2.4.6-p13 pulls magento/module-two-factor-auth 1.1.5-p8, which requires spomky-labs/otphp ^10.0. Every version satisfying that constraint is flagged:

$ curl -s -X POST https://packagist.org/api/security-advisories/ -d 'packages[]=spomky-labs/otphp'
PKSA-qv5y-crcz-9nxw  affected=<11.4.3  Mass-assignment in Factory::loadFromProvisioningUri
PKSA-kbc7-dq62-pt7d  affected=<11.4.3  Unbounded digits parameter -> DivisionByZeroError

^10.0 resolves to v10.0.0 ... v10.0.3 and nothing else, and the fix landed in 11.4.3. So there is no safe version 2.4.6 can accept — policy.advisories.ignore-id would not be a workaround, it would be shipping both flaws in the image.

This surfaced now rather than earlier because Dockerfile.base does COPY --from=composer:2, a floating tag. #37 touched docker/**, which rebuilt the base for the first time since 3 September and picked up a composer that blocks advisory-affected packages. The breakage predates #37; the rebuild merely exposed it.

2.4.7 and 2.4.8 pin newer Magento (2.4.7-p4, 2.4.8) and should resolve against otphp 11.x. This PR is what actually proves that — those four jobs were cancelled by fail-fast last run, so they have never completed.

Nothing uses 2.4.6

Consumer	Tag
two-inc/magento-docker/Dockerfile	FROM ghcr.io/brtkwr/magento:2.4.8
charts/magento/values.yaml	tag: "2.4.8"
org-wide code search for magento:2.4.6	no hits

Also in here

• release.yaml built only 2.4.6 and tagged it :2.4.6, :latest and the release version — so :latest pointed at the oldest and now-unbuildable image while everything real runs 2.4.8. It now builds 2.4.8.
• fail-fast: false on the image matrices. Last run, one arm64 failure cancelled five other jobs and left us with no information about them. These builds are independent; one failing should not hide the rest.
• Deleted docker/composer.json — a byte-identical duplicate of composer-2.4.6.json that nothing reads. The Dockerfile writes composer.json inside the image from composer-${MAGENTO_VERSION}.json, so the context copy was dead weight.

Merge order

#38 first, then this. Merging #38 alone would trigger a docker/** rebuild that still includes 2.4.6 and fails again.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GFS4uN8RLpnbeLmvmB2Rbu