Discover all packaged PHP claim surfaces - #10

Problem

The PHP guard enumerated selected files by hand, so a new root guide, docs subtree, or non-PHP package-data file could bypass it. It also lacked the fixed monthly allowance and requests-per-period aliases enforced in the other SDKs. No current false claim was found in Packagist v2.1.0; this closes the PHP discovery gap for OilpriceAPI/oilpriceapi-api#5644.

Red / green

Red before implementation:

• the future Composer file regression failed because no archive-wide validator existed
• a nested docs/guide.md with 1,000 API requests/month and JSON package data with 100 requests per hour bypassed the old PHP-only list

Green at e8e9c26:

• full PHPUnit: 23 tests, 277 assertions
• strict Composer validation: green
• Composer audit: no advisories
• exact generated Composer archive: clean-installed and all 16 customer-readable files scanned
• exact packaged fixtures: success, missing config, 401, 403, and 429 green
• binary package data is excluded; future UTF-8 files of any name or extension are discovered
• git diff --check: clean

Change

• scan every UTF-8 file in the exact installed Composer archive
• add fixed allowance and requests-per-period aliases, with the canonical 50 requests/day exception
• explicitly exclude CI, tests, scripts, lock/cache, Git metadata, and vendor dependencies from the customer archive
• bind the clean-install smoke to the installed vendor package and add future nested docs/package-data regressions

Runtime source and Client::VERSION remain unchanged at 2.1.0, so no new Packagist artifact is required.