Release Server 2.3.8 with Workflow activity deadline repair

[rmcdaniel]

Change

Pin published Workflow 2.0.11, which fixes expired-lease repair bypassing activity deadlines (durable-workflow/workflow#503). Prepare Server 2.3.8 and Helm 0.1.87 through the existing source-release manifest/generator. Composer resolves exactly one dependency update; no SDK or wire-protocol change.

Validation

Workflow main CI and Packagist publication pass. Source release synchronization and diff checks pass; normal repository CI will run here. The full local generator test requires PHP, absent on the shell host, so its result is deferred to the existing CI environment rather than counted as a pass.

After image publication, verify its installed Workflow identity and repeat the affected published activity/replay conformance against the exact image. Prior Server 2.3.7 qualification is recorded in #152 and does not substitute for this release.

[rmcdaniel]

Server 2.3.8 and Helm 0.1.87 are published and verified by release run 34395801156. The downloaded image durableworkflow/server@sha256:df7f541fe547a35dd36240e7c6d7ae18a0caf51299180a62e63615270781124f contains Workflow 2.0.11 at 91123158bfd87467fd6c3d420b26ad1965d226fd.

Published-artifact qualification using repository runner 25f6dd9:

• scripts/conformance/activities-published-artifacts.sh: all 12 checks passed (11 runtime scenarios plus published-install identity), no findings. Completed September 9 at 19:46:35 UTC. Covers embedded PHP, PHP SDK and Python SDK activity behavior, retries/timeouts, heartbeat/cancellation, completion idempotency and operator visibility; this is not a Rust activity-matrix claim.
• scripts/conformance/replay-published-artifacts.sh: all 31 checks passed, September 9 19:44:26-19:49:21 UTC. Includes PHP/Python completed-history and worker-restart scenarios, Rust side-effect/version-marker replay, and malformed/mutated history refusal.
• Exact tuple: Server 2.3.8, Workflow 2.0.11, PHP SDK 2.0.9, Python SDK 2.0.4, Rust SDK 2.0.5, CLI 2.0.0, Waterline 2.0.2. Product artifacts were downloaded, not replaced with local source. Disposable containers were removed.

Separate main-branch CI finding: feature run 34395544211 hit a SQLite concurrent completion-upload assertion (responses 503 retryable lock pressure and 409 conflicting bytes). Investigating the committed-reservation/cold-retry expectation directly; not treating the failed run as a pass or changing release tags.