SECURITY UPDATE: restore path separator in phar_get_link_location() so the
CVE-2026-7260 cycle walk stays idempotent (GHSA-vc5h-9ppw-p5f3)
debian/patches/CVE-2026-7260.patch: restore path separator in
phar_get_link_location() so the CVE-2026-7260 cycle walk stays idempotent
(GHSA-vc5h-9ppw-p5f3)