ci: restore the PMU_VERSION pin that the merge up dropped

[ousamabenyounes]

main is currently red in 90 of its 91 failing checks, and so is every pull
request targeting it — #8448
shows 108 failures, all from the same step.

Cause

#8442 pinned the build tooling by introducing PMU_VERSION in the workflow env:
block and rewriting every call site to soyuka/pmu:$PMU_VERSION. That landed on
4.3. Merging up to main kept the 21 rewritten call sites but dropped the
env: entry that defines the variable, so the command expands to:

composer global require "soyuka/pmu:"

and composer aborts:

##[error]Option soyuka/pmu is missing a version constraint, use e.g. soyuka/pmu:^1.0

In BaseCommand.php line 403:
  Option soyuka/pmu is missing a version constraint, use e.g. soyuka/pmu:^1.0

Every job that installs pmu dies there — the step is variously named
Update project dependencies, PMU or Linking, which is why the failure looks
like several unrelated problems. It is one.

Change

• Restore the PMU_VERSION entry in env:, with the same value and comment as 4.3.
• Constrain the one call site ci: pin build tooling to exact versions #8442 did not cover — the Upgrade Filter Codemod
  job still ran the unpinned composer global require soyuka/pmu, which is exactly
  what that comment warns against.

Validation

This is a workflow-config change, so there is no meaningful unit test to add. The
invariant it restores is checkable directly — every composer global require soyuka/pmu must carry a constraint, and that constraint must resolve:

	PMU_VERSION defined	pmu requires	using $PMU_VERSION	unconstrained
main before	no	22	21	1
main after	yes	22	22	0
4.3 (reference)	yes	21	21	0

CI on this PR exercises the fix directly: the jobs that abort on main are the
same ones that must reach their real work here.

[ousamabenyounes]

CI on this PR is red, and that is the point of it — worth spelling out so the list is not misread as fallout from a four-line workflow change.

Before this PR, 90 of main's 91 failing checks died at the same step, at composer global require "soyuka/pmu:", before running anything. With the env entry restored the jobs get past install and reach their real work, which makes the pre-existing failures on main visible for the first time. They fall into three groups:

1. Fixed by #8445 — the constraint under-declaration these jobs were always going to hit:

• PHPUnit api-platform/doctrine-orm (PHP 8.5 lowest) and doctrine-odm: Trait "ApiPlatform\Doctrine\Common\Filter\NameConverterAwareTrait" not found — --prefer-lowest installs doctrine-common 5.0.0-alpha.1, which does not ship that trait.
• PHPUnit api-platform/json-api (PHP 8.5 lowest): OperationNotFoundException: Operation "" not found for resource "CircularReference".

2. Pre-existing on main, unrelated to pmu — these fail on test fixtures, not on tooling:

• PHPStan (PHP 8.5): Class ApiPlatform\Tests\Fixtures\TestBundle\Document\SearchFilterParameter not found, Call to an undefined method ApiPlatform\Tests\Functional\Parameters\DoctrineTest::loadFixtures().
• The main PHPUnit suites (8.2, 8.5, PostgreSQL, MySQL, MongoDB, Symfony 8.1 / dev / lowest, no-deprecations, event listeners): e.g. PHP 8.2 reports Tests: 2074, Errors: 4, Failures: 4.
• Upgrade Filter Codemod (8.5): fails in Functional suite — this was already the single non-pmu failure on main before this change.

3. codecov/project — coverage delta on a workflow-only diff.

Nothing in group 2 or 3 can be caused by defining an env variable; they were simply unreachable while every job aborted at install. Happy to split any of them into its own PR if you'd like them tracked separately.