ci: port the current pipeline generation to 3.0.x

[Spomky]

Why

The 3.0.x pipeline was still the previous generation — integrate.yml + infection.yml, tools pulled from require-dev, tool configuration at the repository root — and it has been red since November 2025:

• Rector could not boot at all: PHPUnitLevelSetList no longer exists in rector-phpunit.
• Exported files targeted ubuntu-20.04, a runner image GitHub has retired — the job never got a runner, which is why those runs sat at 24 h before being cancelled, taking the test matrix with them.
• Coding standards / static analysis ran against tool versions that have moved on since.

What

The 4.0.x setup is used here as well: one ci.yml running every check inside the phpqa image, tool configuration under .ci-tools/, and the matching castor tasks. Root-level ecs.php, rector.php, phpstan.neon, phpunit.xml.dist and infection.json are gone, as are integrate.yml and infection.yml.

Adjusted for this branch:

• Rector targets PHP 8.0 (LevelSetList::UP_TO_PHP_80) and keeps the Symfony code quality set of the previous configuration.
• ECS moves to the fluent ECSConfig::configure() API and keeps this branch's MbStrFunctionsFixer rule. Two files were reformatted by it (import order, comment spacing).
• The test matrix runs PHP 8.2, 8.3, 8.4 and 8.5 (experimental).
• The exported files list matches what this branch actually ships.
• .ci-tools/phpstan-baseline.neon is generated: 11 entries, all ergebnis architecture rules that a Symfony bundle cannot satisfy (Extension inheritance, ContainerBuilder parameters).
• require-dev keeps only symfony/framework-bundle; every QA tool now comes from the image.

Pipeline bugs fixed along the way

These are not specific to the port — 4.0.x carries them too, and the merge up will take the fixes there:

• The composer cache key was empty. It is built from hashFiles('composer.lock'), but composer.lock is not committed, so every job shared the composer-Linux- entry whatever branch produced it. The PHPStan job analysed this branch against a vendor/ restored from elsewhere (Symfony 8.1), reporting errors no baseline of this branch can match. The key now hashes composer.json as well.
• castor requires PHP >= 8.4, so castor phpunit could not run on the 8.2 and 8.3 images. PHPUnit is invoked directly in the test matrix, as cbor-php already does, and the castor task pins phpunit-11 — the only PHPUnit binary present in every image of the matrix.
• Infection could not run at all: its configuration resolved src from the repository root although the file lives in .ci-tools/, the mutation job consumed a coverage report nothing produced, and PHPUnit's "cannot order by defects" warning combined with failOnWarning made the initial run execute zero tests. Paths fixed, the job now installs dependencies and generates coverage, and .ci-tools/phpunit.xml.dist sets an explicit executionOrder.

Verification

The pipeline is green on this PR: pre-checks, PHPStan, ECS, Rector, lint, Deptrac, licenses, composer validate --strict, exported files, and the test matrix on 8.2, 8.3, 8.4 and 8.5. Mutation testing is skipped on pull requests (if: endsWith(github.ref_name, '.x')) — it was verified locally: it runs, kills 1 mutant of 14, and exits 0 with --min-msi=0.

Two things to decide

• No lowest-deps entry on this branch. The released constraints allow Symfony 5.3 to 7.x per component, and --prefer-lowest resolves them into cross-major mixes (config 5.4 with dependency-injection 6.0) that fail at container boot and that no real installation produces. Raising the floor to 5.4 is not enough; it also needs symfony/service-contracts: ^3.0 in require, as 4.0.x has. I left the published constraints untouched — say the word if you would rather tighten them and keep the job.
• composer.json still declares "php": ">=8.0", but no phpqa image exists below 8.2, so PHP 8.0 and 8.1 are no longer exercised.