feat(php): wire release pipeline

[countradooku]

Summary

Closes #3304.

• add sdk-php release metadata and PHP SDK metadata checks
• add a reusable PHP extension build workflow for PIE-compatible archives across PHP 8.3/8.4, Linux glibc/musl, macOS, x86_64/arm64, plus a PHP-scoped source archive and binary license manifest
• publish PHP SDK artifacts as monorepo GitHub release assets behind the php-sdk-* tag
• keep Packagist out of this monorepo pipeline until a split repository or root composer.json package source exists
• keep the PHP iggy Rust SDK dependency version synchronized with core/sdk, matching the Python binding pattern
• include PHP in the post-merge SDK auto-publish loop without blocking Docker or other SDK publishing on PHP binary builds

Notes

PECL is intentionally skipped. The current pipeline follows the Composer/PIE packaging direction for pre-built extension archives, but Packagist publishing is not enabled from apache/iggy because Packagist indexes a root composer.json and derives VCS versions from tags in the indexed repository.

This also broadens extract-version.sh --is-pre-release from the previous edge/rc match to SemVer prerelease suffixes so PHP -dev, -edge, and -rc versions use the same post-merge auto-publish gate as the other SDKs.

Validation

• bash -n scripts/bump-version.sh scripts/ci/php-sdk-version-sync.sh scripts/extract-version.sh
• shellcheck scripts/bump-version.sh scripts/ci/php-sdk-version-sync.sh scripts/extract-version.sh
• YAML parse for edited workflows/actions/config via Ruby YAML.load_file
• actionlint -shellcheck= .github/workflows/publish.yml .github/workflows/post-merge.yml .github/workflows/_build_php_extensions.yml .github/workflows/_common.yml
• ./scripts/ci/php-sdk-version-sync.sh --check
• ./scripts/ci/php-sdk-version-sync.sh --fix
• PATH="/tmp/iggy-yq-v4.47.1:$PATH" ./scripts/extract-version.sh --check
• ./scripts/bump-version.sh --status rust-sdk
• ./scripts/bump-version.sh rust-sdk --patch --edge --dry-run
• ./scripts/bump-version.sh --status sdk-php
• cargo metadata --manifest-path foreign/php/Cargo.toml --no-deps --format-version=1
• ./scripts/bump-version.sh sdk-php --patch --edge --dry-run
• php -r 'json_decode(file_get_contents("foreign/php/composer.json"), true, 512, JSON_THROW_ON_ERROR);'
• git archive --format=tar.gz --prefix=apache-iggy-php-test/ --output=/tmp/iggy-php-source-test.tar.gz HEAD:foreign/php

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.73%. Comparing base (4a48008) to head (78d8a87).
⚠️ Report is 13 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3500      +/-   ##
============================================
- Coverage     74.27%   73.73%   -0.54%     
  Complexity      937      937              
============================================
  Files          1259     1284      +25     
  Lines        125969   127093    +1124     
  Branches     101644   102008     +364     
============================================
+ Hits          93558    93710     +152     
- Misses        29396    30317     +921     
- Partials       3015     3066      +51     

Components	Coverage Δ
Rust Core	75.16% <ø> (+<0.01%)	⬆️
Java SDK	49.17% <ø> (-9.40%)	⬇️
C# SDK	71.40% <ø> (-0.71%)	⬇️
Python SDK	88.88% <ø> (ø)
PHP SDK	84.29% <ø> (ø)
Node SDK	91.26% <ø> (+0.03%)	⬆️
Go SDK	40.14% <ø> (-0.23%)	⬇️
see 78 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[atharvalade]

overall lgtm just some nits

[hubcio]

scripts/bump-version.sh is not updated

[countradooku]

/ready

[countradooku]

/ready