[vitormattos]

Summary

Migrate the release engine to PHP 8.5 and Symfony 8.1, preparing release-tool v0.12.0, while isolating development/testing tools via bamarni/composer-bin-plugin 1.9.1.

Dependency isolation

• The root composer.json keeps only bamarni/composer-bin-plugin in require-dev. Symfony 8.1 runtime libraries remain in require.
• PHPUnit, Infection, PHPStan, Psalm, PHPMD, PHPCS, PHP-CS-Fixer, Rector, Deptrac, and Box have separate vendor-bin/<tool>/composer.json manifests and committed lockfiles.
• Box's Symfony 7 dependencies remain isolated from the runtime Symfony 8 dependency graph.
• Explicit Composer scripts use namespaced binaries; the CI installs only the required namespace for each job.
• Infection points to the isolated PHPUnit binary via phpUnit.customPath. The Composer quality job validates and audits every namespace and the root.
• Regression tests and developer documentation cover the installation and isolation contracts. Dependabot monitors the root and all vendor-bin manifests.

Runtime and Actions

• Require PHP 8.5 and use Symfony Console addCommand().
• Each public composite Action configures PHP 8.5 before executing the PHAR, independently of the Nextcloud application's packaging PHP.
• Migrate PHP quality, PHPUnit, Infection, PHAR, and publication workflows to PHP 8.5.
• Prepare VERSION=0.12.0 without publishing an unreleased PHAR.

Local verification (PHP 8.5.12)

• PHPUnit: 315 tests, 1,139 assertions passed.
• Infection with Xdebug 3.5.3: 3,121 mutations, 100% mutation code coverage, ~77% MSI (minimum 75%).
• PHPStan, Psalm, PHPMD, PHPCS, PHP-CS-Fixer, Rector, and Deptrac passed.
• Isolated Box 4.7.1 built the PHAR, and PHAR smoke tests passed.
• composer validate --strict and composer audit --locked passed for root and all namespaces (no advisories).
• Commits are cryptographically signed and DCO-compliant.

Rollout

Do not pin consumers to an unpublished PR SHA. After merging and publishing the immutable v0.12.0 PHAR and checksum, update release-tool SHA pins in LibreCodeCoop/.github and downstream consumers (LibreSign and profile_fields). The shared publisher's drift checks depend on published, immutable Action revisions.

CI status should be verified on the current PR head before merging.