Test the lowest allowed dependency set in CI

[fain182]

composer.lock is not committed, so every CI job resolved to the newest release allowed by composer.json: the lower bounds of the declared constraints were never executed, even though consumers installing arkitect as a dev dependency often end up on them.

Adding that job to the matrix surfaced three problems:

• with phpstan/phpdoc-parser v1 the docblock nodes carried no line numbers, because on v1 they are opt-in through the $usedAttributes constructor argument (on v2 they are already requested through ParserConfig). Dependencies declared in docblocks were still detected, but reported on the wrong line, so violations pointed at the wrong place
• phpstan/phpdoc-parser below 1.20 lexes @ORM\Id as the ORM tag, so doctrine-like annotations were collected under a truncated FQCN and the rules on them silently did not match
• nikic/php-parser below 5.3 cannot parse property hooks, so any file using them produced no class description at all despite 8.4 being an accepted --target-php-version

The version constraints are raised to the lowest release that actually works, and mikey179/vfsstream to the first one that runs on PHP 8: 1.6.0 uses curly brace string offsets, removed in PHP 8.

The Composer cache key was keyed on a composer.lock that does not exist, which made it a constant shared by every job; it now includes the PHP version and the resolution strategy.

Claude-Session: https://claude.ai/code/session_01WMkvCCKkaZe1CU1cUREKQN

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.77%. Comparing base (b45dc5e) to head (835bf37).

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #672      +/-   ##
============================================
+ Coverage     97.58%   97.77%   +0.18%     
  Complexity      767      767              
============================================
  Files           102      102              
  Lines          2198     2198              
============================================
+ Hits           2145     2149       +4     
+ Misses           53       49       -4     

Flag	Coverage Δ
highest	97.58% <0.00%> (?)
lowest	97.54% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/Analyzer/DocblockParserFactory.php	100.00% <100.00%> (+28.57%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.