feat(php-rpc): embed the Composer PHP runtime in the executable

Plugins and scripts need the real `Composer\` classes and the packages
Composer depends on, which so far came from a checkout found through
SHIRABE_COMPOSER_PHP_DIR or a path next to the workspace. Neither exists
for a distributed binary.

The build script now archives those PHP sources into a phar the way
Compiler.php does and the executable carries it. The worker maps it with
Phar::loadPhar and reads a content-addressed sentinel back to tell a
bundle it can use from one it cannot; where its PHP cannot open the phar,
the bundle is unpacked once into the cache directory and autoloaded from
there. SHIRABE_COMPOSER_PHP_DIR still overrides both for development.

PHP locates a phar's manifest by the first __HALT_COMPILER(); token in
the file, so the executable must hold no other copy of it: phar.rs builds
the token at run time, and a linter keeps further literals out of the
sources that reach the binary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 8 insertions, 5 deletions

diff --git a/docs/dev/php-rpc.md b/docs/dev/php-rpc.md
index 8418db88..b1c992d7 100644
--- a/docs/dev/php-rpc.md
+++ b/docs/dev/php-rpc.md
@@ -7,12 +7,15 @@ runtime.
 The `shirabe-php-rpc` crate spawns the system PHP as a child process and talks to it over a Unix
 domain socket. There is exactly one child process per Shirabe process, shared by every caller.
 
-## Locating PHP
+## Locating and spawning PHP
 
-The existing `PhpExecutableFinder` class resolves the PHP binary. The child is started with
-`-d serialize_precision=-1` so the wire codec's float formatting is pinned to the default PHP
-behavior, and with `-d xdebug.mode=off` unless `COMPOSER_ALLOW_XDEBUG` asks for Xdebug to stay
-(see `xdebug.md`).
+The existing `PhpExecutableFinder` class resolves the PHP binary.
+
+The child is started with the following arguments:
+
+* `-d serialize_precision=-1` for stable float formatting of `serialize()`/`unserialize()`
+* `-d phar.require_hash=0` (see [docs/dev/composer-runtime-bundle.md](./composer-runtime-bundle.md))
+* `-d xdebug.mode=off` (see [docs/dev/xdebug.md](./xdebug.md))
 
 ## Transport