1.3.0-rc2: silent-failure fix on missing purger config

Cut after the 1.3.0-rc1 production-soak handback from portal-master
surfaced a silent failure mode: when lscache_purger.settings is
missing from active config (likely from a partial config-sync
round-trip on the operator side), purge_host reads as NULL, the
host fallback chain in CLI/cron context collapses to empty, every
tag invalidation bails with FAILED, and the only signal is a single
watchdog warning that operators don't naturally check when drush
just says FAILED.

The bug has existed since 1.0.0-alpha2 (purger code unchanged
through every release). The original prefix-mismatch hypothesis
was ruled out by the env-session diagnostic showing identical
TagHeaderBuilder::getPrefix() values on web and CLI.

What landed since 1.3.0-rc1 (commit 676931f):

- c0d7706: defensive install + backfill update hook on the
  lscache_purger submodule. ensure_settings_exist() runs in
  hook_install after the Purge plugin wiring; lscache_purger_
  update_8101() catches existing installs in the gap state via
  drush updb.

- 72f613a: status report row for the purger surfaces three states
  (missing config, empty purge_host, OK). markAllFailed() also
  surfaces its failure reason via $this->messenger()->addError()
  so drush invocations show the cause inline instead of only in
  watchdog.

- 1c53f72: README clarification that the lscache.settings:enabled
  toggle controls header emission only; LSWS-side caching is
  governed by the .htaccess CacheLookup directive separately. To
  fully bypass LSWS for a debugging window, comment out the
  directive rather than just toggling the module off.

- 02047cf: regression-guard tests for the missing-host failure
  path. LscachePurgerTest covers the gap state (no config + no
  request stack + no $base_url) for both single and batch
  invalidations.

- d65f454, 38a46cc, f037d9b: three CI fix-up commits addressing
  PHPStan, PHPCS, CSpell, and PHPUnit feedback (messenger via
  MessengerTrait, missing docblocks, banned-words swap, missed
  function spacing, plugin id placement).

Strict bug-fix only relative to rc1; no API contract changes. The
"everything" invalidation type that was discussed for this cycle
was deferred to 1.3.1 or 1.4.x to preserve rc API freeze.

Operator-experience polish from the rc1 hand-back report (status
report directives summary, vary_cookies recent-traffic validation,
demo ESI submodule + block-form ESI checkbox + drush list command)
all carry over to the polish window after 1.3.0 stable.

Finding 7 (auth-served-as-anon variant) from the rc1 hand-back is
still outstanding; diagnostic ask queued to send to the env
session alongside this rc2 deployment.