Audit follow-up: the ignore file lists a project that raises nothing

Two corrections from auditing the delta since 1.0.0-alpha2.

The ignore file named a project that raises nothing

The DebugClassLoader return-type pattern listed audit_trail alongside key. audit_trail raises no such deprecations, which its own next-major lane demonstrates: that lane is green while carrying a pattern naming only key, paragraphs and entity_reference_revisions, and reported zero return-type deprecations. So the entry never matched anything.

Dead config would be harmless; pre-silencing a project maintained alongside this one is not. The file states the rule three lines above: a deprecation naming a project we maintain is a real finding and belongs fixed at the source, which is how the Transaction deprecation in [#3614430] was handled. The comment now says why only key is listed.

A stale CI comment

The comment above the opt-in variables read "Kessai requires Drupal ^11.3", written before [#3614379] widened the requirement to ^11.3 || ^12. The floor has not changed, so it was not wrong, only stale beside the value under it.

No CHANGELOG

Considered and deliberately not added. The release node is the canonical changelog for a contributed project, and a second surface that needs manual syncing every release is precisely the failure this audit turned up in audit_trail, where CHANGELOG.md claimed no release existed through six tags. Release notes cover it without the duplication.

Rest of the audit

Clean. All six info files carry ^11.3 || ^12; composer.json needs no core entry since the info file drives packaging. Every concrete claim in the README was checked against the code: eight base fields, both capability interfaces, all six named methods and the settings route exist. The setAccessible(TRUE) removal is correct, a no-op since PHP 8.1. PaymentManager is the only file using transactions and no implicit-commit pattern remains. No prose still claims Drupal 11 only.