chore: add release package validation foundation

[josiahking]

Summary

Adds the EvolvePHP 2 Phase 2.10A deterministic release-readiness foundation for the six first-party packages.

This phase prepares package boundaries for future dry-run splitting without creating package repositories, publishing packages, creating tags, or adding release automation.

Changes

• adds an explicit six-package release map and dependency-compatible processing order
• adds deterministic repository-owned release package validation
• adds package-local README files for future split roots
• propagates the repository BSD-3-Clause licence into each package subtree
• verifies package manifests, dependency graph and topological release order
• verifies package README/licence readiness
• adds release:validate to the EvolvePHP workspace
• documents the deterministic release-validation boundary
• records Phase 2.10A in the changelog

Release Package Order

1. evolvephp/contracts
2. evolvephp/core
3. evolvephp/module
4. evolvephp/plugin
5. evolvephp/http
6. evolvephp/testing

The order is dependency-compatible. core, module and plugin remain logically parallel-capable after contracts.

Release Validation

Run:

composer --working-dir=workspace release:validate

The validator is:

• deterministic
• read-only
• network-free
• repository-owned
• standard-library PHP only
• portable across supported development/CI environments

It validates:

• release package mapping
• package identity
• Composer metadata
• PHP ^8.4
• BSD-3-Clause licence policy
• absence of hard-coded package versions
• PSR-4 mappings
• exact internal dependency graph
• internal ^2.0 constraints
• no production dependency on evolvephp/testing
• acyclic dependency graph
• topologically valid processing order
• package-local README and licence presence
• licence equality with root LICENSE.md
• generated/publication garbage exclusions

Package Documentation

Each package now contains:

• README.md
• LICENSE.md

The READMEs clearly state that:

• EvolvePHP 2 is pre-release
• packages are not yet independently published
• no current public composer require command is claimed
• the canonical source remains the EvolvePHP monorepo

No future split-repository URLs are guessed.

Licence Integrity

The root licence and all six package licence files have the same SHA-256:

1ded61f80154a4c6efe0cfe0afba89d50393df4f6d1f52783ddfe00d3a6371cf

Validation

• release-readiness RED: 7 tests, 17 assertions, 7 expected failures
• release-readiness GREEN: 7 tests, 257 assertions
• negative fixtures: 14/14 expected failures passed
• README consistency: 13 tests, 130 assertions
• RFC consistency: 11 tests, 126 assertions
• Documentation: 117 tests, 1,471 assertions
• Architecture: 47 tests, 2,977 assertions
• complete root suite: 164 tests, 4,448 assertions
• PHP 8.4 policy suite: 164 tests, 4,448 assertions
• workspace PHPUnit: 6 tests, 18 assertions
• all six package Composer manifests validate strictly
• Deptrac: 0 violations
• PHPStan: no errors
• PHP-CS-Fixer: 0 files fixable
• aggregate workspace quality passed
• supply-chain passed
• release:validate passed
• workspace and root lockfiles unchanged

Scope

Exactly 18 files:

• 12 package-local README/licence files
• tests/Documentation/EvolvePhp2ReleaseReadinessTest.php
• workspace/release-packages.json
• workspace/tools/validate-release-packages.php
• workspace/composer.json
• workspace/README.md
• CHANGELOG.md

No package Composer manifests, dependency versions, lockfiles, CI workflows, RFCs, root metadata or GitHub settings are changed.

Deferred to Phase 2.10B

• dry-run git subtree split
• generated split-tree validation
• isolated prerelease consumer resolution
• Composer prerelease stability behavior
• remote repository naming/ownership
• Packagist decisions
• tags/releases
• remote synchronization