fix: use error_log for config-cache permission warning (closes #615)

[s2x]

Description

Closes #615

Changes

• ConfigLoader::validateCacheFilePermissions() no longer emits the fail-open config-cache permission warning via trigger_error(..., E_USER_WARNING) when no PSR-3 logger is available; the warning is now written directly via error_log().
• A throwing error handler (e.g. Symfony DebugErrorHandler in debug mode, which escalates E_USER_WARNING to ErrorException) can no longer turn the advisory "fail-open with a signal" warning into a hard boot failure — fail-open stays fail-open, while unrelated warnings still reach the error handler as before. This mirrors the codebase-wide no-logger convention (ServerWorker, HttpRequestHandler, RequestConverter, and the [Bug] SfxDownloader zip-extraction cleanup does not handle unlink() failure — self-perpetuating loop from #642 can persist silently #670 precedent).
• New test testValidateCacheFilePermissionsDoesNotThrowWithThrowingErrorHandlerAndNoLogger pins the semantics: with a throwing E_USER_WARNING handler installed, the no-logger unreadable-metadata path completes without an exception, the handler is never invoked for E_USER_WARNING, and the warning still reaches the log via error_log().
• Updated the two trust-downgrade no-logger tests to capture error_log() output.
• docs/security.md, the [Unreleased] [Enhancement] Add an explicit opt-out for the config-cache ownership guard #648 opt-out CHANGELOG entry, and the validateCacheFilePermissions() phpdoc updated to document the error_log() channel and why.

Changelog

Under [Unreleased] > Fixed: ConfigLoader no longer emits the advisory config-cache permission warning via trigger_error(E_USER_WARNING); it is written via error_log() so a throwing error handler cannot turn the fail-open warning into a hard boot failure.

Proof of Work

docs/proof_of_work/0615-configloader-e-user-warning-fallback/ — 4 review rounds (F1-F6 all resolved)

Code Review

• Passed subagent code review
• Every finding answered