1.5.2: take shared-menu 1.2.1, which centres the glyph

Kristian reported the infinity sign sitting above centre in the admin menu on
the live shop. Security traced it to WordPress's own stylesheet rather than
adjusting it by eye: #adminmenu div.wp-menu-image is 36x34 and its :before
carries padding 7px 0, which is exactly 7 + 20 + 7 for a 20px dashicon at
line-height 1. The 1.2.0 rule set line-height 1.4 and inherited that padding,
so the pseudo-element was 42px tall inside a 34px parent.

1.2.1 reproduces the box, drops the padding and centres with flex — geometry
rather than a nudge, because U+221E sits on the maths axis instead of filling
its em box.

It is the same half-done abstraction as the escaping fix: the filter made the
character configurable and left the geometry tuned for one specific character.
Nothing could fail, because the only value anyone ever passed was the one it
was tuned for.

Verified before copying, including the part that makes the check meaningful:
Security predicted php -w WOULD differ this round, since the executable code
changed — so equal stripped hashes would have meant the wrong file. They
differ, and the diff is the version constant plus the CSS geometry, with
wpmgr_css_escape untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci/plugin.conf

@@ -75,7 +75,11 @@ RELEASE_REPO=kw/nolimit-discounts-dist
 # The frozen hash is therefore a family-wide fact, not a local one, and taking
 # a new one is something all six do in the same window.
 #
-# 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes
+# 678f1f03 = contract 1.2.1: the glyph is centred with flex inside an explicit
+# 36x34 box instead of inheriting WordPress's 7px padding, which made the
+# pseudo-element 42px tall inside a 34px parent and pushed the sign above
+# centre. Kristian reported it from the live shop.
+# Earlier: 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes
 # rather than through esc_attr(): HTML entities are not decoded by the CSS
 # parser, so esc_attr was protecting by coincidence — and a backslash, which it
 # leaves alone, IS a CSS escape and swallowed the closing quote. Changing the
@@ -83,4 +87,4 @@ RELEASE_REPO=kw/nolimit-discounts-dist
 # backslashes, hex digits and spaces, so there is nothing left to leave the
 # string with. Verified here against seven hostile inputs.
 # Earlier frozen hashes: 184cebdc = 1.1.0, f4862d5c = 1.0.0.
-WPMGR_MENU_SHA=9012fe98d867b86c993cee2f8d7b0b9fe5b89817fed4cf45346aa4949e2df307
+WPMGR_MENU_SHA=678f1f0368fcc781ce34c0289f6470a6bb0491bc32c0598e859c7ceba66e5e2a