ci: adopt checked PHP syntax discovery

[bnjmnrsh]

The shared PHP syntax sweep could hide a failed file discovery command. Adopt the reviewed provider revision from RocketsAreNostalgic/.github#143 so both PHP lanes propagate discovery failures before invoking the parser.

Only the quality-php-library-v2.yml commit pin changes: 84dde4704058d71646f56c369981bb6aaf201e24 to 87e0b380092e0780861a5d9f6690a07f9d3dd0ac. The provider remains reachable from merged .github main. Its complete workflow delta is the two reviewed checked-discovery repairs; caller inputs, PHP8.0/8.5 support lanes and terminal gates are unchanged. The existing pull-request-only trigger is preserved.

Validation: full local composer check passed with locked dependencies, including PHPStan, both standards profiles, and54 tests/756 assertions; exact one-line substitution and git diff --check passed. Exact-head native CI and independent PR review remain required. Base: e83bf2e.

No runtime, dependency, release or publication changes. Await Ben's specific merge decision.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T19:39:27.783596Z	08210bc	PR opened
🔒 Security Review	✅ Completed 2026-10-07T19:40:36.606384Z	08210bc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[bnjmnrsh]

Independent technical review of base e83bf2e → head 08210bc: no blocking finding. Actual PR diff changes only the quality-php-library-v2.yml commit pin. Existing pull-request-only trigger, PHP 8.0/8.5 inputs, permissions and terminal gates remain intact. Independently fetched old/new provider workflows and verified their only differences are the two checked temporary-file discovery repairs; file selection and parser behavior are preserved while find failures now propagate. Provider 87e0b380092e0780861a5d9f6690a07f9d3dd0ac remains reachable from merged .github main with identical tree. Applicable AGENTS reviewed. Native Quality run 37675839560 remains in progress; no unresolved review threads. This technical COMMENT does not authorize merging. Exact-head native success and Ben's specific merge decision remain required.

[bnjmnrsh]

Qualification complete for head08210bc4dbf6092a5a0cd4d2e336fd38bfebaddf against basee83bf2e3953936c5a34b6675109974795b655312. Published treea9f3a4af0c4544ee57e0b6a33a4b5962187bc3ae matches the independently checked local content exactly. Full local composer check passed, including54 tests/756 assertions. Native Quality37675839560 passed PHP8.0 floor, PHP8.5 compatibility and terminal quality; GitGuardian passed. Independent review5447403710 records no blockers. No remaining tracked old84dde pin or unresolved review thread. Existing pull-request-only trigger remains unchanged, so this repository has no automatic post-main Quality run. Await Ben's specific merge decision; no merge/publication performed.