feat(php-rpc): embed the Composer PHP runtime in the executable

Plugins and scripts need the real `Composer\` classes and the packages
Composer depends on, which so far came from a checkout found through
SHIRABE_COMPOSER_PHP_DIR or a path next to the workspace. Neither exists
for a distributed binary.

The build script now archives those PHP sources into a phar the way
Compiler.php does and the executable carries it. The worker maps it with
Phar::loadPhar and reads a content-addressed sentinel back to tell a
bundle it can use from one it cannot; where its PHP cannot open the phar,
the bundle is unpacked once into the cache directory and autoloaded from
there. SHIRABE_COMPOSER_PHP_DIR still overrides both for development.

PHP locates a phar's manifest by the first __HALT_COMPILER(); token in
the file, so the executable must hold no other copy of it: phar.rs builds
the token at run time, and a linter keeps further literals out of the
sources that reach the binary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2 files changed, 10 insertions, 3 deletions

diff --git a/crates/shirabe/tests/common/php_worker.rs b/crates/shirabe/tests/common/php_worker.rs
index 4be064e4..af1b6b44 100644
--- a/crates/shirabe/tests/common/php_worker.rs
+++ b/crates/shirabe/tests/common/php_worker.rs
@@ -24,8 +24,8 @@ pub fn lock_php_worker() -> std::sync::MutexGuard<'static, ()> {
         .unwrap_or_else(|poisoned| poisoned.into_inner())
 }
 
-/// Requires the Composer PHP runtime (`composer/vendor/autoload.php`) into the worker, which is
-/// what makes the real `Composer\` classes autoloadable there.
+/// Requires the Composer PHP runtime's `vendor/autoload.php` into the worker, which is what makes
+/// the real `Composer\` classes autoloadable there.
 pub fn load_composer_php_runtime() {
     shirabe::event_dispatcher::EventDispatcher::__ensure_composer_php_runtime().unwrap();
 }
diff --git a/crates/shirabe/tests/installed_versions_test.rs b/crates/shirabe/tests/installed_versions_test.rs
index 9b81c3c8..b8c65485 100644
--- a/crates/shirabe/tests/installed_versions_test.rs
+++ b/crates/shirabe/tests/installed_versions_test.rs
@@ -512,12 +512,19 @@ fn test_worker_loads_the_installed_versions_file_shirabe_dumps() {
     let _worker = lock_php_worker();
     load_composer_php_runtime();
 
+    // Read in the worker rather than from Rust: the file it autoloads lives inside the runtime
+    // bundle, which only the PHP side has a stream wrapper for.
     let loaded = string_of(&php_eval(
         r"return (new \ReflectionClass(\Composer\InstalledVersions::class))->getFileName();",
     ));
+    let contents = string_of(&php_eval(
+        r"return file_get_contents(
+            (new \ReflectionClass(\Composer\InstalledVersions::class))->getFileName()
+        );",
+    ));
     assert_eq!(
         include_str!("../../../composer/src/Composer/InstalledVersions.php"),
-        std::fs::read_to_string(&loaded).unwrap(),
+        contents,
         "the worker autoloads {loaded}, which must match the file Shirabe dumps",
     );
 }