Phase 1 sub-commit 7: CI quality job

PHPStan (level 6 + symfony extension) and PHP CS Fixer (Symfony +
PHP83Migration ruleset) configs at framework/php/. composer.json
exposes phpstan / cs:check / cs:fix / phpunit / quality scripts.
PHPStan-clean across the bundle; cs:check is happy after auto-fix
applied @Symfony idioms (yoda, leading-backslash JSON_*, blank-line
before return). Test mocks consolidated into a HubSpy helper to keep
PHPStan happy about by-ref captures.

Skeleton's Makefile target `quality` chains `composer quality` (in
framework/php/) with cmake's all_qmllint target. Local run is green —
11 tests / 32 assertions, no PHPStan errors, cs-fixer clean, qmllint
emits advisory warnings only.

Layout fix in skeleton's Main.qml: status-dot Rectangles inside
RowLayout now use Layout.preferredWidth/Height instead of width/height
to satisfy Quick.layout-positioning checks.

.gitea/workflows/ci.yml replaces the placeholder with a real `quality`
job: setup-php, composer install (cached), the four PHP checks, Qt 6
via install-qt-action (cached), QML module build, qmllint via the
all_qmllint CMake target. Workflow exists from this commit onward
even if a runner isn't provisioned yet.

bridge:doctor lost the Publisher dependency since it was only used as
a "service is wired" marker — the command being injectable already
proves that.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

framework/php/composer.json

@@ -31,5 +31,16 @@
             "PhpQml\\Bridge\\Tests\\": "tests/"
         }
     },
+    "scripts": {
+        "phpstan":  "phpstan analyse --memory-limit=512M",
+        "cs:check": "php-cs-fixer check --diff --allow-unsupported-php-version=yes",
+        "cs:fix":   "php-cs-fixer fix --allow-unsupported-php-version=yes",
+        "phpunit":  "phpunit",
+        "quality": [
+            "@phpstan",
+            "@cs:check",
+            "@phpunit"
+        ]
+    },
     "minimum-stability": "stable"
 }