Modernize for PHP 8.4+, Symfony 6.4/7.4/8.1+, PHPUnit 12

[lyrixx]

Summary

• Raises the minimum requirements: PHP ^8.4, symfony/process ^6.4 || ^7.4 || ^8.1, phpunit/phpunit ^12.0, psr/log ^3.0; drops phpspec/prophecy-phpunit (its one use site now uses native PHPUnit mocks)
• Adds full property/parameter/return type coverage across src/, with readonly wherever a property is genuinely write-once, and final/final readonly on every class that permits it (dropped the redundant per-property readonly on classes already declared readonly at the class level)
• Converts the test suite from doc-comment metadata (@dataProvider, @before, @after, @beforeClass) to PHPUnit 12 attributes, since PHPUnit 12 no longer reads the old annotations; renames AbstractTest to AbstractTestCase so PHPUnit's *Test.php glob doesn't try to run it directly
• Updates CI (PHP 8.4/8.5 matrix + a prefer-lowest job, composer validate), phpunit.xml.dist (PHPUnit 12 schema), and README/CONTRIBUTING for the new baseline
• Drops StyleCI: no .styleci.yml or workflow step existed for it, so this removes every textual reference (README badges, CONTRIBUTING mentions) — actually uninstalling the GitHub App is a repo-settings action outside this PR
• Adds php-cs-fixer, PHPStan and Castor tooling, mirroring JoliCode's own JoliNotif setup:
  • php-cs-fixer and phpstan each live in tools/<name>/ with their own isolated composer.json/lock, wired together via a root castor.php. castor install, castor cs, castor phpstan and castor phpunit all work end to end
  • .php-cs-fixer.php: @PHP84Migration + @PhpCsFixer + @Symfony(:risky), with gitlib's own license header enforced via header_comment — ran it for real across the codebase (58 files reformatted, all mechanical; it also filled in the license header on two files that were missing it entirely)
  • phpstan.neon: level 9 on src/. Fixed the ~20 findings that were real bugs or design smells rather than annotation gaps (see below); the remaining ~94 are baselined in phpstan-baseline.neon
  • CI: check-cs and phpstan jobs pinned to PHP 8.4 (our floor) using castor-php/setup-castor@v1.1.0
  • CONTRIBUTING.md: Castor install step, "Standard code" and "Static analysis" sections
• Fixes bugs surfaced along the way:
  • Log's ReferenceNotFoundException call silently dropped the chained previous exception (the constructor didn't accept it)
  • DiffTest called restore_exception_handler() instead of restore_error_handler(), leaking error handlers between tests
  • a dead @dataProvider on ReferenceTest::testIsBranchMergedToMaster wastefully cloned repositories it never used
  • Reference\Tag::getCommit() could pass an undefined $commitHash to getCommit() when show-ref returned no matching row
  • Repository::getDiff(null) and Log::getCommits()'s catch block would fatal-error calling a method on null on a reachable path (a Log built with no revision filter)
  • Repository's $gitDir/$workingDir were readonly-assigned outside the constructor; moved to a static resolveDir() helper
  • Repository's single $objects cache (typed Commit|Tree|Blob) split into three properly-typed caches
  • RevisionList/Tree array-shape narrowing fixed by restructuring the loops that build them
  • ReferenceBag::update() and a new getAs() helper made generic so createBranch()/getTag()/etc. return their real narrow type
  • CommitReference was missing a getHash() getter entirely
  • Blob::getMimetype() honestly typed string|false (finfo::buffer() can fail)

The remaining PHPStan baseline entries are mostly Commit/Reference\Tag's untyped getData(): mixed internals, and Repository::run()'s ?string return propagating into code that assumes a string. Fixing those properly means redesigning that data-caching layer or auditing every run() call site for the debug=false null case — bigger than this PR's scope.

Test plan

• vendor/bin/phpunit — 215 tests, 0 failures (against PHP 8.5.4 locally)
• composer update --prefer-lowest then vendor/bin/phpunit — passes against the floor of the new dependency ranges (symfony/process 6.4.33)
• composer validate --strict
• castor cs --dry-run — clean
• castor phpstan — clean (with baseline)