Tighten PHPCS and improve CI

[tommitchelmore]

CI Overhaul

This PR introduces a large overhaul to our CI pipeline, to tighten it up and improve DX going forwards.

CI Changes

• Scoped push events to master and added a concurrency group with cancel-in-progress: true to prevent redundant builds.
• Explicitly restricted job permissions to contents: read.
• Refactored the strategy matrix to use dependency_type (stable vs. lowest) and disabled fail-fast to ensure complete tests across all versions which is helpful for debugging.
• Migrated from php-actions/composer action to direct composer update CLI calls, saves a redundant docker container being spun up
• Replaced deprecated/commented Coveralls logic with CodeCoverageSummary, injecting a markdown report directly into the GitHub Job Summary (restricted to PHP 8.3 stable builds).
  • This addresses Enable lovely Coveralls again #47 - Coveralls is a dependency nightmare, so a leaner summary feels like a sensible direction to head in.
  • Example: https://github.com/Rareloop/lumberjack-core/actions/runs/25726781824

Code changes

• Tightened PHPCS
• Fixed all codestyle issues

Future work

We have made a note to add in PHPStan/similar in a future major release. This is because a full static analysis pass will result in a lot of breaking changes.