feat(php-rpc): embed the Composer PHP runtime in the executable

Plugins and scripts need the real `Composer\` classes and the packages
Composer depends on, which so far came from a checkout found through
SHIRABE_COMPOSER_PHP_DIR or a path next to the workspace. Neither exists
for a distributed binary.

The build script now archives those PHP sources into a phar the way
Compiler.php does and the executable carries it. The worker maps it with
Phar::loadPhar and reads a content-addressed sentinel back to tell a
bundle it can use from one it cannot; where its PHP cannot open the phar,
the bundle is unpacked once into the cache directory and autoloaded from
there. SHIRABE_COMPOSER_PHP_DIR still overrides both for development.

PHP locates a phar's manifest by the first __HALT_COMPILER(); token in
the file, so the executable must hold no other copy of it: phar.rs builds
the token at run time, and a linter keeps further literals out of the
sources that reach the binary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 8098761e..ea05e168 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2154,8 +2154,10 @@ name = "shirabe-php-rpc"
 version = "0.0.1"
 dependencies = [
  "anyhow",
+ "flate2",
  "indexmap",
  "nix",
+ "sha2 0.11.0",
  "shirabe-php-shim",
  "shirabe-php-src",
  "shirabe-symfony-process",